Risk Management

Every organisation manages risk; far fewer do it in a way that changes decisions. The familiar failure pattern is a risk register updated twice a year, scored by habit, reviewed without challenge — right up until one of the risks on it materialises and the board asks why the framework did not help.

Our risk management services build and test frameworks that work: risks identified honestly, appetite defined so managers know what they may accept, mitigation that is real rather than asserted, and reporting that tells boards what is changing rather than restating what they already knew. Delivery is senior partner-led, drawing on more than 20 years of cross-sector risk experience.

Risk Identification and Assessment That Reflects Reality

A framework is only as good as the risks it captures. We facilitate structured risk identification across strategic, financial, operational, technology, people, regulatory and reputational categories — drawing on workshops, data and cross-sector experience of where organisations like yours actually get hurt. Each risk is assessed for likelihood and impact on a consistent scale, distinguishing inherent exposure from the position after controls, so the register shows where you truly stand rather than where policy says you should.

Risk Appetite: Deciding What You Will Accept

Risk appetite is the most under-used tool in governance. Defined well, it tells every manager which risks they may accept, which need escalation and which the organisation will not carry at any price — turning hundreds of daily judgement calls into consistent decisions. We help boards articulate appetite statements that connect to strategy, translate them into practical tolerances and limits, and embed them in the approval processes where decisions are actually made.

Embedding: Ownership, Mitigation and the Three Lines

Risk management fails when it belongs to one manager and a spreadsheet. We embed clear ownership using the three lines model — management owning and managing risk, oversight functions setting frameworks and monitoring, and internal audit providing independent assurance. Mitigation plans get owners, dates and tests of effectiveness, and key risk indicators give early warning while there is still time to act.

Board Reporting and Assurance Mapping

Boards need to know what is changing, what is outside appetite and what management is doing about it — on one page if possible. We design risk reporting that achieves that, and build assurance maps showing which sources of comfort cover which key risks, exposing the gaps and duplications. For companies within reach of the UK Corporate Governance Code, this is also the groundwork for the board's declaration on the effectiveness of material internal controls under Provision 29.

Audit or Advisory — or Both

Engagements run in two modes. Advisory: building or upgrading your framework, from first risk register to full enterprise risk management. Audit: independently testing the framework you already have — whether risks are complete, scoring is honest, mitigation is real and reporting reaches the board intact. Both are available fully outsourced, co-sourced with your team, or as focused ad-hoc reviews, time-bound with budget certainty.

What You Get With Acumon

• Risk identification and assessment across all major risk categories
• Risk appetite statements translated into practical tolerances and limits
• Clear risk ownership embedded through the three lines model
• Mitigation plans with owners, dates and tests of effectiveness
• Key risk indicators that give early warning, not late confirmation
• One-page board risk reporting and assurance mapping
• Independent audits of existing risk management frameworks

Why Acumon for Risk Management?

• Senior partner-led engagement
• 20+ years of cross-sector risk management experience

Get a Fixed-Fee Quote

Tell us what you need and we'll come back within one business day with a clear scope and a fixed price — no hourly-rate surprises. Call 020 8567 3451 or use the form and we'll be in touch.