What is the difference between risk management and incident response?

Risk management is a proactive, structured process for identifying, assessing, and responding to potential threats before they materialise. Incident response is a reactive process that addresses damage after a threat has activated. Both are necessary, but they are not interchangeable, and confusing one for the other leaves organisations permanently behind the threat curve.

What is ISO 31000 and why does it matter?

ISO 31000:2018 is the international standard for risk management published by the International Organisation for Standardisation. It provides a set of principles, a framework, and a process that can be applied to any organisation regardless of size, sector, or geography. It defines risk as 'the effect of uncertainty on objectives,' which shifts focus from avoiding all risk to managing the uncertainty that surrounds every organisational decision.

How do you define risk appetite?

Risk appetite is the amount and type of risk an organisation is prepared to accept in pursuit of its objectives. It should be documented, approved at board level, differentiated by risk category (financial, reputational, operational, compliance), and reviewed annually or when there is a material change in the organisation's circumstances.

Why do most businesses fail at risk management?

The primary reason is incentive misalignment. Organisations reward managers for responding to crises and rarely recognise the prevention of crises that never occurred. This creates a cultural bias toward reactive behaviour that structural changes in the risk management process must consciously counteract.

Why Most Businesses Manage Symptoms, Not Risk

A company's warehouse burns down. Insurance pays. New warehouse built. Leadership declares the crisis handled. Six months later, a product liability claim closes the business. Nobody had asked what category of threat the company was genuinely exposed to, because the warehouse fire consumed all available attention and felt, at the time, like the entire story of risk.

That sequence plays out across industries, across organisation sizes, and across economies every year. Businesses confuse the urgency of incidents with the discipline of risk management, and the confusion is entirely understandable because incidents produce visible, measurable pressure while risk identification produces none. One demands a response; the other requires deliberate, unrewarded effort.

The distinction matters enormously in practice. Incident response asks: what happened and how do we fix it? Risk management asks: what could happen, how likely is it, what would it cost us, and what do we do about it before it happens? These are different questions that require different skills, different information, and different organisational habits.

"Organisations that only respond to what has already happened are perpetually behind. Risk management is not about prediction. It is about preparation. You will not anticipate every threat, but you can build the capacity to absorb shocks that you did not see coming."
— Salihah Budall, MSc., CFS, CRMP, CSSYB

The Reactive Trap

The reactive approach to risk is not irrational. It is a rational response to resource constraints. When a medium-sized manufacturing firm has a compliance officer handling three departments, and a fire alarm requires immediate action while a risk register update does not, the alarm wins every time. The problem is structural: organisations are built to respond to events, not to anticipate them, and the incentive structures reinforce this at every level.

A manager who responds brilliantly to a crisis gets praised. A manager who runs a thorough risk assessment in January that prevents a crisis in October gets nothing, because the connection between the assessment and the absence of a crisis is invisible. Risk management success looks like nothing happening. This invisibility is one of the field's most persistent professional challenges, and it explains why board-level sponsorship of risk management processes is so strongly correlated with their actual effectiveness.

ISO 31000:2018, the international standard on risk management, describes risk as "the effect of uncertainty on objectives." That framing is deliberately broad. It does not say risk is bad; it says risk is deviation from what you planned. An organisation that grows 60% above its capacity projection faces risk just as surely as one that loses a major client. Both represent uncertainty affecting objectives, and both require a response that the reactive model will not generate until something breaks.

What Risk Management Actually Does

Properly implemented, risk management performs three functions that incident response cannot replicate. First, it forces an organisation to articulate what it is actually trying to achieve, because you cannot assess threats to your objectives without first knowing what your objectives are. This sounds obvious, but many organisations operate without explicit, documented objectives at the department level, which makes any attempt at risk identification partly fictional.

Second, it builds a shared vocabulary for uncertainty. When a leadership team agrees on what "high likelihood" means in the context of their business (whether that is 30% probability or 70% depends on the industry, the asset, and the timeframe), decisions become more consistent. Without that shared vocabulary, one director's "unlikely" is another's "probable," and the company's risk appetite exists only as a vague sentiment rather than a decision-making tool.

Third, it creates an audit trail of reasoning. When a risk materialises that was identified and accepted by the board two years prior, the organisation can demonstrate that the decision to accept rather than mitigate was informed, deliberate, and appropriately authorised. That paper trail matters enormously in regulated sectors. It matters even in unregulated sectors when litigation, insurance disputes, or stakeholder accountability becomes relevant.

"The organisations that survive disruption are rarely the ones that reacted fastest. They are the ones that had already thought through the scenarios, documented their assumptions, and put controls in place before the event arrived."
— Salihah Budall, MSc., CFS, CRMP, CSSYB

The Three Categories Organisations Consistently Miss

Operational risks get attention because they produce visible incidents. A system goes down, a shipment is delayed, a contractor fails to deliver. These are tractable, and most organisations develop some competence in addressing them over time through experience if not through formal process.

Strategic risks are far more dangerous and far less visible. The decision to enter a new market, acquire a competitor, or transition to a subscription model each carries risk that does not show up until months or years after the commitment was made. By then, reversing course is expensive and sometimes impossible. The International Federation of Risk and Insurance Management Associations, in their 2023 Global Risk Report, identified strategic risk misalignment as the primary driver of enterprise value destruction in mid-market organisations, ahead of operational failures and ahead of regulatory penalties.

Emerging risks are the category that genuinely separates mature risk functions from immature ones. These are risks that exist in some nascent form today but have not yet produced incidents. They require horizon scanning, scenario analysis, and a willingness to invest resources in threats that the organisation has never experienced. Cyber risk fits this description for most small businesses in the early 2010s; supply chain concentration risk fits it for manufacturing firms in the years before 2020. Neither was invisible in advance. Both were deprioritised because more immediate pressures absorbed available attention.

Moving from Reactive to Structured

The transition from incident response to structured risk management does not require a large team or an expensive framework deployment. It requires a small number of disciplined habits applied consistently over time. Organisations that have made this shift successfully share several observable characteristics.

They set aside formal time for risk identification that is separate from operational review. Monthly or quarterly risk reviews exist in the calendar before any incident occurs, and they happen whether or not there is a pressing operational issue. This scheduling discipline is more important than the sophistication of the methodology used.

They document risk decisions, not just risk identification. Knowing that a risk exists is not enough if there is no record of who decided to accept, mitigate, transfer, or avoid it. The decision record is what transforms risk management from a bureaucratic exercise into a governance tool with actual accountability attached.

They distinguish between the risk register and the issue log. The risk register captures what might happen. The issue log captures what is happening. Both are necessary; they address different timeframes and require different management responses. Conflating them produces a document that is half-useful for two different purposes rather than fully useful for either.

Finally, they calibrate risk appetite explicitly, in writing, and revisit it annually. Risk appetite is the amount of risk an organisation is willing to accept in pursuit of its objectives. It varies by risk category, and it changes as the organisation's financial position, competitive situation, and regulatory environment change. An organisation that treats risk appetite as a fixed, implied cultural understanding rather than a documented, reviewed parameter will find that its risk-taking behaviour drifts without anyone consciously deciding to allow it.

Credit Garden