---
title: "Risk management policy template"
canonical: https://www.grcmana.io/vault/templates/risk-management-policy
published: 2023-10-25
updated: 2026-10-17
author: "Harry West"
framework: "ISO 27001"
type: "Policy"
---

# Risk management policy template

## Key takeaways

A risk management policy sets how an organisation decides which risks matter: its appetite, the scales risks are scored on, and who may accept what remains. ISO 27001 clause 6.1.2 requires defined risk criteria, including acceptance criteria, that give consistent, valid and comparable results. This Word template suits UK firms of 25 to 250 staff.

- **Required by** — ISO 27001:2022 clauses 6.1.2 and 6.1.3 (criteria and processes), applied under clauses 8.2 and 8.3
- **Approved by** — Top management; risk owners approve treatment and accept residual risk
- **Review cycle** — Risks assessed at planned intervals and after significant change; policy reviewed at least annually
- **Format** — Word, about 12 pages, with a 5×5 matrix and register layouts

Two people score the same risk. One says 6, the other says 16, and the auditor asks which is right. Nobody can say, because nothing written down decides it. A risk management policy fixes that before the audit: it sets your risk appetite, the scales you score against and who may accept what, so every assessment lands the same way. This template gives a UK firm of 25 to 250 staff a ready-to-edit risk management policy in Word, built around ISO 27001 clauses 6.1, 8.2 and 8.3.

## What's in the template

One Word document, about 12 pages, version 1.0. It has four parts.

1. **The risk management policy.** Purpose and scope, leadership's commitments, a risk appetite statement in plain terms, roles (top management, the policy owner, risk owners and staff), the risk criteria (five-point likelihood and impact scales, a 5×5 scoring matrix and risk levels), risk acceptance criteria, how risks are treated and linked to your Statement of Applicability, and the cadence and triggers for assessment.
2. **Ready-to-use appendices.** The 5×5 matrix on one page, the column layouts for a risk register and a risk treatment plan, and a risk acceptance record for residual risk.
3. **A getting-started guide and next steps.** Which sections to fill in first, how to test your scales on real risks before approval, and what to build next.
4. **A policy management checklist.** Approval, the first assessment, review dates and reporting to management review: the records an auditor asks to see alongside the policy.

Every placeholder is in square brackets. You write your appetite, put your own numbers into the impact scale, name the people, and the policy is ready for management approval.

The policy sets the rules. The risk register applies them.

Keep the two apart, so adding a risk never needs a policy change, and changing the rules always does.

## What is a risk management policy?

A risk management policy is the document in which leadership sets how the organisation decides which risks matter: how much risk it will accept, how risks are scored, who owns them, who can accept what remains, and how often the picture is refreshed. It governs the risk register and treatment plan rather than containing them.

Auditors ask for it because ISO 27001 is built on risk. Every control you choose, and every one you exclude, should trace back to a risk assessment run against defined criteria. Customers ask for it because their questionnaires want to know how you decide what to fix first, and who signs off on what you don't.

### Policy, methodology and register: which does what?

Most firms blur three records into one spreadsheet, then struggle to show an auditor which part is the rule and which is the result.

| Record | What it holds | Changes when | Approved by |
| --- | --- | --- | --- |
| Risk management policy | Commitments, risk appetite, risk criteria (scales, levels, acceptance thresholds), roles, cadence | Leadership changes the appetite or the rules | Top management |
| Risk assessment methodology | How an assessment is run: who takes part, how risks are identified, how the scales are applied | The method improves | The policy owner |
| Risk register | Each risk, its owner, its scores and the treatment decision | Continuously, as risks are found, rescored or closed | Risk owners, reviewed at management review |
| Risk treatment plan and Statement of Applicability | The actions, owners and dates; the controls chosen and why | As treatment progresses or the controls change | Risk owners approve the plan and accept residual risk |

At 25 staff, the policy and methodology can be one document, as long as the method is written down clearly enough for someone else to repeat it.

### Which standards require one

ISO 27001 doesn't use the words "risk management policy". It requires a defined risk assessment process with documented risk criteria, a risk treatment process, and records of both. A policy is where most firms put the criteria and commitments, so the auditor finds one consistent set of rules.

| Standard or regulator | What it asks for |
| --- | --- |
| ISO 27001:2022, clause 6.1.1 | When planning the ISMS, consider your context (clause 4.1) and interested parties' requirements (clause 4.2), and determine the risks and opportunities to address. |
| ISO 27001:2022, clause 6.1.2 | Define and apply a risk assessment process that establishes and maintains risk criteria, including risk acceptance criteria and criteria for performing assessments; ensures repeated assessments produce consistent, valid and comparable results; identifies risks to the confidentiality, integrity and availability of information in scope, and their risk owners; and analyses and evaluates those risks against the criteria. Retain documented information about the process. |
| ISO 27001:2022, clause 6.1.3 | Define and apply a risk treatment process: select treatment options, determine the necessary controls, compare them with Annex A, produce a Statement of Applicability, formulate a risk treatment plan, and obtain risk owners' approval of the plan and acceptance of the residual risks. Retain documented information about the process. |
| ISO 27001:2022, clause 8.2 | Perform risk assessments at planned intervals, or when significant changes are proposed or occur, using the criteria set under clause 6.1.2. Retain the results. |
| ISO 27001:2022, clause 8.3 | Implement the risk treatment plan. Retain the results. |
| FCA (authorised firms) | SYSC 4.1.1R requires robust governance arrangements, including effective processes to identify, manage, monitor and report the risks the firm is or might be exposed to. It applies in full to common platform firms; SYSC 1 Annex 1 sets how it applies to other firm types, so check yours. |
| DORA (EU financial entities) | A documented ICT risk management framework. |
| Customer due diligence | Security questionnaires commonly ask how risks are assessed, how often, and who approves accepted risks. |

For the depth on each requirement, see the guides to [clause 6.1: risk assessment, treatment and the SoA](https://www.grcmana.io/vault/iso-27001/clause-6-1-actions-to-address-risks-and-opportunities), [clause 8.2: risk assessment cadence and change triggers](https://www.grcmana.io/vault/iso-27001/clause-8-2-information-security-risk-assessment) and [clause 8.3: executing your risk treatment plan](https://www.grcmana.io/vault/iso-27001/clause-8-3-information-security-risk-treatment). For wider reading, ISO 31000 gives general risk management guidelines, and ISO/IEC 27005 gives guidance specific to information security risk.

If you're FCA-authorised, the board will expect information security risk to sit inside the firm's wider risk management, not beside it. Write the appetite and impact scale so the risk committee recognises them as one strand of the enterprise view.

## How to create your risk management policy with this template

With the groundwork in place, this takes about a day of drafting, one management meeting to agree the appetite, and a half-day workshop to test the scales on real risks. Without the groundwork, the policy has nothing to score, so check it first.

### Before you start

Risk criteria only make sense against what you're protecting. Check you have:

- **An ISMS scope statement.** The policy covers the risks inside it. No scope yet? Start with the [clause 4.3 guide](https://www.grcmana.io/vault/iso-27001/clause-4-3-determining-the-scope-of-the-information-security-management-system).
- **A view of what you're protecting.** The information, systems and client services the scope covers, ideally in an asset inventory with named owners. No inventory yet? The [A.5.9 guide](https://www.grcmana.io/vault/iso-27001/annex-a-5-9-inventory-of-information-and-other-associated-assets) covers it.
- **Your context and obligations.** The issues (clause 4.1) and requirements (clause 4.2) that shape your risks: client contracts, UK GDPR, FCA rules if you're authorised. No list yet? See the [clause 4.1 guide](https://www.grcmana.io/vault/iso-27001/clause-4-1-context-of-the-organisation) and the [clause 4.2 guide](https://www.grcmana.io/vault/iso-27001/clause-4-2-understanding-the-needs-and-expectations-of-interested-parties).
- **A senior person who will own the appetite.** Top management sets it, because top management lives with the residual risk that results. The [clause 5.3 guide](https://www.grcmana.io/vault/iso-27001/clause-5-3-organisational-roles-responsibilities-and-authorities) covers assigning the roles.

If none of these exist yet, the job is bigger than one policy. That's the point where most firms bring in help.

**1. Name the owner, the approver and the risk owners** *(about 30 minutes)*

- **Do this:** put names against the policy owner and the approver, and decide which roles can own a risk. A risk owner is the person with the accountability and authority to manage that risk, so pick people who control the budget or the process.
- **The template:** lays out the roles of top management, the policy owner, risk owners and all staff, each with a one-line duty.
- **Watch for:** IT owning every risk. IT can run the controls, but a risk to client delivery belongs to whoever runs client delivery.

A risk owned by IT on behalf of everyone is owned by no one.

**2. Write your risk appetite in plain terms** *(1 to 2 hours, then one management meeting)*

Next, say where the firm will and won't take risk, in sentences a new director could act on. The template gives you an appetite statement by category, such as client data, service availability, regulatory standing and change, with the wording in brackets for you to set. For example: "We have no appetite for risks that could expose client data. We accept moderate risk to internal system availability where it lets us deliver change faster." Then take it to management, because they own it.

> **Where most firms get stuck:** an appetite that says "low" for everything. It reads as prudent and decides nothing. Every risk then looks unacceptable, nothing gets accepted on purpose, and the register fills with risks nobody intends to treat. A real appetite says where you'll take risk, as well as where you won't.

**3. Set your scales and the 5×5 matrix** *(2 to 3 hours)*

- **Do this:** define what each point on the five-point likelihood scale and the five-point impact scale means for your firm. Write impact in your own numbers: money in pounds, hours of client outage, regulatory consequences, reputation. Multiply likelihood by impact for a score out of 25, and set the bands that make a risk low, medium, high or critical.
- **The template:** has both scales pre-filled with descriptors, the impact amounts in brackets for you to set, and a 5×5 matrix with suggested bands (1 to 4 low, 5 to 9 medium, 10 to 16 high, 20 to 25 critical).
- **Watch for:** impact bands sized for someone else's business. "Major: a loss of more than £1 million" means little to a firm turning over £4 million, and everything looks minor.

> **Where most firms get stuck:** scales with no descriptors. "Likelihood 3" means something different to everyone in the room, and clause 6.1.2 asks for repeated assessments to produce consistent, valid and comparable results. Write what each number means, then score five real risks with two different people before you approve the scales. If the scores don't match, the descriptors aren't done.

**4. Set who can accept what, and link treatment to the SoA** *(about an hour)*

Then write the acceptance criteria: which scores a risk owner can accept, which need management sign-off, and which must be treated or escalated to the board with a recorded reason. The template sets these out against the score bands, with a risk acceptance record in the appendices. Say how treatment works too: the options (reduce, avoid, share or accept), how chosen controls feed your [Statement of Applicability](https://www.grcmana.io/vault/iso-27001/clause-6-1-actions-to-address-risks-and-opportunities), and that risk owners approve the treatment plan and accept the residual risk, as clause 6.1.3 requires.

**5. Approve, set the cadence and run the first assessment** *(one management meeting, then a half-day workshop)*

- **Do this:** take the policy to top management for approval and set the next review date. Fix the cadence: a full assessment at least annually, a review of high and critical risks every quarter, and a fresh look whenever something significant changes, such as a new system, a new supplier or an acquisition. Then run the first assessment against the new criteria.
- **The template:** includes the cadence and change triggers, reporting to management review, and a policy management checklist for the approval, first assessment and review dates.
- **Watch for:** a policy approved and a register that never moves. The records that show it working are covered in [How to use it so it holds up at audit](#how-to-use-it-so-it-holds-up-at-audit).

A risk register that never changes isn't a record of risk. It's a record of one meeting.

### Do it yourself, or have us do it with you

|  | Do it yourself with the template | Do it with GRCMANA |
| --- | --- | --- |
| What you end up with | An approved risk management policy with your appetite, scales and acceptance criteria | This policy plus a written methodology, a first risk assessment workshop, a scored risk register, a treatment plan and a Statement of Applicability that trace to each other |
| Your time | About a day plus a management meeting and a half-day workshop, if the groundwork is in place. Considerably more if it isn't | Agreed at scoping, depending on how much of the groundwork is already in place |
| Best if | The groundwork exists and someone on your team is comfortable setting the scales and running the first assessment | Compliance landed on you alongside your day job, you've never run a risk assessment, the audit date is fixed, or a deal is waiting on it |

Prefer the second column? [Talk to us about ISO 27001 risk assessment](https://www.grcmana.io/contact).

## What does a good risk management policy look like?

Most risk management policies say the right things. Fewer give two people enough to score the same risk the same way. Here is the difference.

### Weak and strong, side by side

| Section | Weak | Strong | Why the strong one passes |
| --- | --- | --- | --- |
| Risk appetite | "The organisation has a low appetite for risk." | "We have no appetite for risks that could expose client data. We accept moderate risk to internal systems where it speeds delivery, provided recovery is tested." | It says where risk is accepted, so decisions can be checked against it. |
| Likelihood | "Likelihood is rated from 1 (low) to 5 (high)." | "3 (Possible): could happen in the next one to three years, or has happened to firms like ours." | A descriptor makes scores repeatable, which clause 6.1.2 requires. |
| Impact | "Impact is rated from 1 (minor) to 5 (severe)." | "4 (Major): a loss of £\[100,000\] to £\[500,000\], a client service outage over \[one working day\], or a reportable breach." | It's sized to your firm and covers more than money. |
| Acceptance | "Risks will be accepted where appropriate." | "Risks scoring 9 or below may be accepted by the risk owner. Scores of 10 to 16 need \[MD\] sign-off. Scores of 20 or above must be treated, or accepted by the board with a recorded reason." | Clause 6.1.2 needs risk acceptance criteria. Named thresholds are criteria. |
| Cadence | "Risks will be reviewed regularly." | "A full assessment every \[12 months\], high and critical risks reviewed quarterly, and a reassessment after any significant change listed in section \[x\]." | Clause 8.2 needs planned intervals and change triggers. Both can be tested. |

### What an auditor checks in the first five minutes

Before reading the detail, most auditors check that:

1. **It's current.** It has a version, an approval by top management and a review date that hasn't passed.
2. **The criteria are real.** The scales have descriptors and the acceptance thresholds are named.
3. **The register uses them.** A sampled risk's score can be recomputed from the policy's scales and lands in the right band.
4. **Acceptance has the right signature.** Residual risks above the owner's threshold were accepted by whoever the policy says.
5. **It traces.** Treated risks lead to actions in the treatment plan and to controls in the Statement of Applicability.
6. **It runs on time.** The last assessment happened at the stated interval, and again after the last significant change.

If all six hold, the auditor samples the register with confidence. If one fails, they tend to look harder at every score.

### What good looks like at 25 staff and at 250

| Feature | Around 25 staff | Around 250 staff |
| --- | --- | --- |
| Risk appetite | A few sentences across three or four categories | A statement per category with tolerances, agreed by the board and aligned with enterprise risk |
| Scales | 5×5 with plain descriptors and impact bands in pounds | 5×5 with impact bands matched to the firm's enterprise risk framework |
| Risk owners | Directors, each owning a handful of risks | Heads of function, with the policy owner coordinating |
| Register | A spreadsheet, kept short enough to review in one meeting | A GRC tool or the enterprise risk register, with information security risks tagged |
| Cadence | An annual workshop, and high risks reviewed quarterly at a management meeting | Quarterly reporting to a risk committee, with key risk indicators |
| Acceptance | The managing director signs off high and critical risks | The risk committee or board, with recorded rationale |

The common mistake at 25 staff is a policy written for a bank: committees, tolerances and indicators the firm will never run. The common mistake at 250 is the reverse, a scale written when the firm had 40 people, so every risk now scores as major and nothing can be told apart.

## How to use it so it holds up at audit

The policy is only half the evidence. An auditor tests whether the criteria are applied, and these are the records they usually ask for:

- **The approval record:** who in top management approved this version and its appetite, and when.
- **The risk register:** each risk with its owner, scores against the policy's scales, and the treatment decision.
- **Assessment results:** dated results of each assessment, at the planned interval and after significant changes, as clause 8.2 requires.
- **The treatment plan and Statement of Applicability:** actions with owners and dates, and the controls chosen, each traceable to the register.
- **Risk owners' sign-off:** approval of the treatment plan and acceptance of residual risk, by the person the acceptance criteria name.
- **Management review minutes:** evidence that the risk picture and the status of treatment were reported and discussed.

**The most common reasons this policy fails audit:**

- The criteria are defined, but the register scores risks some other way.
- The scales have no descriptors, so the same risk scores differently each year.
- Residual risk was accepted by someone without the authority, or never formally accepted at all.
- Nothing shows an assessment since a significant change, such as a new core system or an office move.
- The Statement of Applicability doesn't trace to the treatment plan.
- It was copied from a template and names committees, roles or tools the firm doesn't have.

Each of these is cheaper to fix now than to explain in the audit room.

## Risk management policy questions

### What should a risk management policy include?

Its purpose and scope, leadership's commitments, a risk appetite statement, roles and responsibilities, the risk criteria (likelihood and impact scales, risk levels and acceptance thresholds), how risks are treated, and how often risks are assessed and reviewed. It should also say how the policy itself is approved and reviewed.

### What is the difference between a risk management policy and a risk register?

The policy sets the rules: the appetite, the scales and who may accept what. The register applies them, recording each risk, its owner, its scores and the treatment decision. The policy changes rarely and needs top management approval. The register changes whenever risks are found, rescored or closed.

### What is a 5×5 risk matrix?

A grid that scores each risk by likelihood and impact, each rated from 1 to 5. Multiplying the two gives a score from 1 to 25, which falls into a band such as low, medium, high or critical. It only works if each number on each scale has a written description that everyone applies the same way.

### What is the difference between risk appetite and risk acceptance criteria?

Risk appetite is leadership's statement of how much risk the organisation is willing to take, and where. Risk acceptance criteria turn that into rules: which scores can be accepted, and by whom. The appetite sets the direction, and the criteria make it testable in the register.

### How often should risks be reviewed?

A full assessment at planned intervals, usually once a year, and again whenever something significant changes, such as a new system, supplier or service. Many firms also review their high and critical risks quarterly. Keep a dated record of each review, even when nothing changes.

## Get the template

Start from a policy that already sets out the appetite, scales and acceptance rules an auditor looks for, written for a firm your size. Download the Word template, put your own numbers into the scales, and take the appetite to your next management meeting.

*This template is a starting point to adapt to your organisation, not legal advice.*