Risk Analysis

Risk analysis is the governance discipline through which identified risks are examined with sufficient depth and structural rigour to produce the understanding of their nature, interconnections, and potential consequences that sound governance decisions require. It is distinct from risk identification, which establishes what risks exist, and from risk assessment, which scores their likelihood and impact. Risk analysis goes deeper into the conditions that give rise to specific risks, the systemic relationships between risks that can cause individual failures to cascade into much larger governance events, and the root causes that, if unaddressed, will generate recurring risks regardless of the controls applied to their surface expressions. The ISO who governs risk analysis only at the level of individual risk scoring without examining these deeper dimensions is governing with a risk intelligence picture that is accurate as far as it goes but insufficient for the strategic governance purposes it must serve.

The governance significance of risk analysis is amplified by the legal and regulatory obligations that apply to medium and large enterprises, whose principal risk disclosures in annual strategic reports must reflect the quality of risk analysis that informs them. The Companies Act 2006, the Strategic Report and Directors’ Report Regulations 2013, and the 2022 FRC Guidance on Risk Management together establish the framework within which the ISO’s risk analysis outputs must support the board’s corporate governance reporting obligations. The ISO must understand these obligations and govern the risk analysis process to produce outputs that satisfy them with the substance and transparency that regulators and investors require.

Understanding the Risk Analysis Process #

The ISO must govern risk analysis through a structured five-step process that produces the comprehensive, actionable, and reportable risk intelligence that both internal governance and external reporting obligations require.