Risk Management Framework

About this resource

Building your risk management framework

The four documents

Document	What It Is	Who Owns It
	Sets out your organisation's overall approach to managing risk, why it matters, who is responsible, and how risks are identified, managed, and reviewed.	Board endorsed; CEO accountable for implementation
	Describes how much risk your organisation is willing to accept across different areas and where your boundaries are. Helps your Board and team make consistent decisions.	Set, owned, and endorsed by the Board
	A living record of your organisation's key risks, what could go wrong, how serious it would be, who is responsible, and what controls are in place.	Maintained by management; risk owners keep entries current
	A consistent, ready-to-use format for summarising and communicating your organisation's key risks to your Board at regular intervals.	Prepared by management; reported to Board or Board sub-committee

Unfamiliar with a term?

A glossary of risk management terms is available at the bottom of this page.

Why this matters to investors

Funders and government partners increasingly expect organisations to demonstrate sound risk governance. Being prepared builds trust and opens doors to future capital.

Governance

What a risk management framework actually is

You don't need a single master document or a formal structure to manage risk well. What you need is a set of habits: spotting what could knock your mission off course, deciding what you'll do about it, and checking as things change. Good governance, in plain terms, is just making sure the organisation is being run properly, not adding paperwork for its own sake.

The right framework for you is the one that fits where the organisation is today and has room to grow. Start simple. Add layers as you scale.

What you're really managing

For most social enterprises, the risks that matter aren't exotic:

Key-person risk: too much knowledge, too many relationships, or too many tasks resting on one person. What happens if they're suddenly unavailable?
Money: keeping the organisation's finances separate from any founder's, staying on top of cash flow, and meeting your tax and reporting obligations.
Compliance: knowing the rules that apply to your work and the people you serve.
Continuity: being able to keep delivering if a key person, funder, or contract falls away.

Name these honestly and you've done most of the work.

The mindset

Keep your risk documents short, current, and actually used. A register you revisit beats a polished one that sits in a drawer. Set a schedule to review it, even a quick check each quarter, so it reflects how the organisation actually runs.

Governance maturity

Understanding your risk governance stage

Your approach to risk management should reflect where your organisation is in its development. The International Finance Corporation (IFC) describes four stages of SME growth, each with a distinct risk profile and governance approach. Use this as a reference to locate your organisation, then use the tool below to build practices appropriate to your current stage.

While the IFC framework was developed for commercial SMEs, the governance and risk principles apply equally to social enterprises. The tool below adds impact and mission risk considerations specific to your context.

Stage 1 Start-Up Business

Your organisation is focused on developing your product or program and testing the market. Operations are straightforward and the founder is directly involved in almost everything. Formal structures are minimal, and that is appropriate at this stage.

Risk management

Largely informal and intuitive. Founders are directly involved in operations with limited need for checks and balances. Priorities: separate business and personal finances, understand your basic compliance obligations, and begin identifying your most critical risks, particularly your reliance on key people.

Key risks

Over-reliance on the founder; mixing personal and business finances; limited cash flow visibility; mismatch between long-term goals and short-term funding capacity.

Stage 2 Active Growth

Your organisation is growing quickly: programs and operations are expanding, but growth is often organic and unplanned. Complexity is increasing faster than your structures can keep pace.

Risk management

Internal controls begin to emerge. You start identifying key business risks, introduce basic cash management controls, and begin delegating authority. The founder or Chief Executive Officer (CEO) is learning to consult and share decisions rather than retain full control.

Key risks

Loss of control through under- or over-delegation; building roles around available people rather than defined functions; rudimentary controls leaving assets exposed; continued key-person dependency; unequal treatment of stakeholders.

Stage 3 Organisational Development

Your organisation is professionalising: formalising structures, hiring specialist staff, and building systems that can operate beyond the founder. This is a significant and often difficult transition.

Risk management

Risk management becomes structured. Policies and procedures address operational and strategic risks, accountability is assigned to specific roles, and a basic internal audit function may emerge. An executive committee or advisory board provides oversight alongside the CEO. Formal documentation of processes, authorities, and reporting lines is a priority.

Key risks

Inconsistent practices while old and new ways of working coexist; founders bypassing new structures; checks-and-balances gaps during transition; conflict between long-standing and incoming staff.

Stage 4 Business Expansion

Your organisation resembles a larger institution in structure, management, and governance. Decision-making is institutional. External investors and professional boards expect strong risk management, reliable reporting, and formal accountability.

Risk management

Proactive and strategic. Internal controls are systematic: the IFC references frameworks such as COSO (Committee of Sponsoring Organisations of the Treadway Commission) as the basis for an effective controls system at this stage. Independent external auditors provide assurance. The board actively oversees the organisation's overall risk exposure, and risk is integrated into strategic planning and board reporting.

Key risks

Over-administration and bureaucracy slowing innovation; management becoming risk-averse; founder or family control persisting behind professional structures; rising overhead without commensurate capability growth.

Source: IFC Corporate Governance for SMEs, 2020. The framework was developed for commercial SMEs; governance and risk principles have been adapted here for the social enterprise context.

Three Lines Model: Organisations reaching Stage 3–4 in governance complexity may encounter the Three Lines Model, a framework that assigns risk responsibility across three layers: business units (first line, owning day-to-day risk), risk and compliance functions (second line, providing oversight and challenge), and internal audit (third line, providing independent assurance). This model suits organisations where oversight complexity and regulatory demands are increasing significantly. It is not a requirement at earlier stages.

Share feedback

Used this tool? If something doesn't land, seems off, or could be clearer, we'd love to hear from you.

Give feedback

Reference

Glossary of terms

32 of 32 terms

Board

The governing body of an organisation, responsible for strategic oversight, accountability, and setting the organisation's risk appetite. The Board provides oversight of the risk management framework and ensures that risk is considered in all major decisions.

Chief Risk Officer (CRO)

The executive responsible for leading the design, implementation, and ongoing operation of the risk management framework. In smaller organisations, this role may be performed by the CEO, CFO, or another designated risk lead rather than a dedicated position.

Control

A measure or action put in place to manage, reduce, or eliminate a risk. Controls can be preventative (stopping a risk from occurring) or detective (identifying when a risk has occurred so it can be addressed).

Control Effectiveness

An assessment of how well a control is working in practice. A control may exist on paper but still be rated as ineffective if it is not consistently applied or if it does not sufficiently reduce the risk.

Direction of Travel

An indicator used in risk reporting to show whether a risk is improving, stable, or worsening since the last review. It provides the Board with a forward-looking signal, not just a point-in-time snapshot.

Escalation

The process of referring a risk, issue, or incident to a higher level of management or governance when it exceeds a defined threshold, is outside appetite, or requires a decision beyond the authority of the current risk owner.

Horizon Scanning

The practice of identifying and monitoring emerging risks, trends, and developments in the external environment that may affect the organisation in the future. It supports proactive rather than reactive risk management.

Inherent Risk

The level of risk present before any controls or mitigating actions are applied. It represents the raw exposure to a risk in the absence of any management response.

ISO 31000:2018

The international standard for risk management, published by the International Organisation for Standardisation. It provides principles, a framework, and a process for managing risk that can be applied to any organisation regardless of size or sector. This tool is aligned to its principles.

Key Risk Indicator (KRI)

A quantitative or qualitative measure used to provide an early warning signal that a risk is increasing or approaching the organisation's tolerance threshold. KRIs help organisations monitor risk trends between formal reviews.

Likelihood

The probability or chance that a risk event will occur. Likelihood is typically assessed on a scale (for example, rare, unlikely, possible, likely, or almost certain) and is one of two key dimensions used to determine the overall level of a risk.

Line 1 (First Line of Defence)

Business units and operational teams that own and manage risks on a day-to-day basis. They are the primary owners of risk and are responsible for implementing controls within their areas of responsibility.

Line 2 (Second Line of Defence)

The risk and compliance function that provides independent oversight, guidance, monitoring, and challenge to Line 1. Line 2 supports the organisation to manage risk consistently and in accordance with the risk management framework, without taking ownership of the risks themselves.

Line 3 (Third Line of Defence)

Internal audit or external assurance providers that offer independent assurance to the Board and senior management on the effectiveness of governance, risk management, and internal controls.

Maturity

A reference concept used in this tool to describe the level of capability an organisation has developed in a particular area of risk management. Maturity descriptors (Initial, Developing, Consistent, Evolved, and Optimised) are provided as reference points to help organisations identify their current state and define a proportionate target state, not as a scored assessment.

Near-Miss

An event or situation that did not result in harm or loss but had the potential to do so. Near-misses are important learning opportunities and should be captured and reviewed alongside incidents.

Not-for-Profit (NFP)

An organisation that operates for a purpose other than generating profit for its owners or shareholders. NFPs include charities, community organisations, and social enterprises. The ACNC Governance Standards apply to registered charities in Australia.

Residual Risk

The level of risk remaining after controls and mitigating actions have been applied. The residual risk level is compared to the organisation's risk appetite to determine whether further action is required.

Risk

The effect of uncertainty on objectives. Risk can be negative (a threat) or positive (an opportunity). In the context of this tool, risk refers primarily to events or circumstances that could adversely affect the organisation's ability to achieve its mission and strategic objectives.

Risk Appetite

The amount and type of risk an organisation is willing to accept in pursuit of its strategic objectives. Risk appetite is set by the Board and documented in the Risk Appetite Statement. It provides a reference point for decision-making across the organisation.

Risk Appetite Statement

A formal document, approved by the Board, that sets out the organisation's appetite and tolerance for risk across key risk categories. It defines where the organisation draws the line and what action is required when that line is approached or crossed.

Risk Assessment

The overall process of identifying risks, analysing their likelihood and consequence, and evaluating them against the organisation's risk appetite and tolerance. Risk assessment informs decisions about how risks should be treated and prioritised.

Risk Culture

The shared values, attitudes, and behaviours relating to risk that exist across an organisation. A healthy risk culture is one where people feel safe to raise concerns, where leadership models good risk behaviour, and where lessons from incidents and near-misses are actively applied.

Risk Management Framework

The set of components , including policies, procedures, roles, responsibilities, processes, and tools, that together provide the foundation for managing risk across an organisation. The framework translates risk strategy and appetite into day-to-day practice.

Risk Management Strategy

A document that sets out an organisation's overall approach to risk management, including its objectives, principles, roles and responsibilities, key processes, and review arrangements. It provides the strategic foundation from which the risk management framework is built.

Risk Owner

The individual or team responsible for managing a specific risk. The risk owner is accountable for ensuring that appropriate controls are in place, that the risk is monitored, and that escalation occurs when required.

Risk Register

A structured record of an organisation's identified risks, including their description, likelihood, consequence, inherent and residual risk levels, existing controls, risk owners, and status. The risk register is a living document reviewed and updated on a regular basis.

Risk Reporting

The process of communicating risk information to the Board, sub-committees, and management on a regular basis. Effective risk reporting provides decision-makers with an accurate, timely picture of the organisation's current risk profile, including risks outside appetite, key risk trends, and emerging risks.

Risk Tolerance

The acceptable variation around a risk appetite position, the boundary at which a risk becomes unacceptable and action is required. Tolerance is more specific than appetite and is often expressed in quantitative or qualitative terms.

Risk Treatment

The process of selecting and implementing options to address a risk. Common treatment options include avoiding the risk, reducing its likelihood or consequence, transferring it (for example, through insurance), or accepting it where it falls within appetite.

Social Enterprise

An organisation that applies commercial strategies to achieve social, cultural, or environmental objectives. In this guide, the term is used broadly to include not-for-profits, charities, and community organisations operating in Australia.

Vulnerable Persons

Individuals who may be at greater risk of harm due to their age, disability, circumstance, or other factors. Organisations working with vulnerable persons, such as children, people with disability, or those experiencing hardship, typically operate under heightened risk and safeguarding obligations.

Building your risk management framework

What a risk management framework actually is

What you're really managing

The mindset

Understanding your risk governance stage

Build your starting draft

Glossary of terms