Strategic Business Leader · Identification, assessment and measurement of risk

Risk Models and Frameworks: Cause, Effect and Sources

Updated 11 October 2026 · Fact-checked

Risk models and frameworks give you a structured way to describe risk: where it comes from (source), what triggers it (cause) and what it does (effect). You then record it in a risk register and choose a TARA response: transfer, avoid, reduce or accept. In SBL, you apply each step to the scenario.

Understand Risk Models and Frameworks: Cause, Effect and Sources

Risk is the possibility that an outcome differs from what was expected, with a chance of loss or of missed objectives. Exposure to risk is the extent of that possible loss. Uncertainty is wider: you cannot assign reliable probabilities to outcomes. With risk, you can often estimate likelihood and impact. With uncertainty, you often cannot. Many texts treat risk as measurable and uncertainty as not measurable, but in SBL do not overstate this. Say it is a matter of degree.

A good risk analysis separates three things. The source is where the risk originates, such as a supplier, a regulator, a new technology or the company's own staff. The cause is the event or condition that makes the risk happen, such as a supplier going bankrupt. The effect is the consequence for the business, such as lost sales, fines or reputational damage. Exam answers lose marks when these three are mixed together. Write them as a chain: source, cause, effect.

Classification frameworks help you find risks. A common approach is to group them as strategic, operational, financial, compliance and reputational risks. Another approach splits them into external risks (for example political, economic or technological change) and internal risks (for example weak controls, fraud or poor culture). Another is business risk versus non-business risk: business risk comes with the strategy chosen, while non-business risk (such as a rate rise on borrowing) arises from the wider environment. Use whichever the scenario fits best. The aim is a clear, complete list, not a label for its own sake.

A risk register records each risk with its description, source, likelihood, impact, a rating or ranking, the chosen response, an owner and the status of mitigation. It turns analysis into action and lets the board monitor risks over time. The TARA framework then sets the response: Transfer (for example insurance, outsourcing or hedging), Avoid (do not undertake the activity), Reduce (controls that cut likelihood or impact) and Accept (live with it, usually for low-rated risks). The right choice depends on likelihood, impact, cost of the response and the board's risk appetite.

Key rules to remember

Risk chain: Source → Cause → Effect; Use it to structure any risk description. Each risk should show all three links.
Risk rating (common approach): Risk rating = likelihood × impact; Used to rank risks on a register or heat map. It is a ranking tool, not an exact measure, so state your scoring scale.
TARA responses: Transfer | Avoid | Reduce | Accept; Match the response to likelihood, impact, cost and risk appetite. Say why the others are less suitable.
Typical risk register columns: Risk | Source | Likelihood | Impact | Rating | Response | Owner | Status; Exact layout varies. Always include a response and an owner.

How to solve Risk Models and Frameworks: Cause, Effect and Sources questions

Use this method for any SBL requirement on risk models, classification, registers or responses. Keep the answer tied to the scenario.

1Read the requirement and note the verb: identify, assess, evaluate, recommend or explain. This sets the depth of your answer.
2Scan the scenario for risk clues: new markets, suppliers, technology, regulation, weak controls, culture, debt, and stakeholder pressure.
3For each risk, state the source, cause and effect in one or two sentences, using scenario facts.
4Classify the risk (for example strategic, operational, financial, compliance, reputational), only if the requirement asks for it or it helps your argument.
5Assess likelihood and impact, and rank the risks. Tie your view to the company's risk appetite.
6Choose a TARA response for each major risk. Justify it by cost, effect and appetite, and name the specific action.
7Add owner, monitoring and reporting if the question involves a register or governance.
8Finish with a clear recommendation and show professional skills: prioritise, be sceptical of assumptions, and write for the audience.

Quickest way: Source-effect-TARA in three lines

When to use it: When time is short and the requirement asks you to identify and respond to risks.

Pick the three to five biggest risks from the scenario. Do not list everything.
For each, write one line: source, cause, effect, using scenario facts.
Add one line: likelihood and impact (high, medium or low) and the TARA response with its specific action.
Close with one sentence on which risk the board should deal with first and why.

Common mistakes in Risk Models and Frameworks: Cause, Effect and Sources

Listing generic risks that are not in the scenario.
You recall a textbook list and write it out.
Fix: Use scenario facts and name the company, product, market or event for every risk.
Mixing up source, cause and effect.
They are closely linked, so they blur together.
Fix: Write them as a chain. Ask: where does it start, what triggers it, and what happens to the business.
Naming TARA responses without explaining the choice.
You treat the framework as a memory test.
Fix: State the action, why it fits the likelihood and impact, and what the cost or drawback is.
Saying risk is always measurable and uncertainty never is.
Textbook contrasts are remembered as absolute rules.
Fix: Say that risk usually allows estimates of likelihood and impact, while uncertainty is where reliable probabilities are hard to assign. It is a matter of degree.
Producing a risk register with no owner, response or monitoring.
You focus on listing risks and forget the management purpose.
Fix: Include rating, response, owner and status. Explain how the board will review it.
Recommending avoidance for every major risk.
Avoidance feels safest.
Fix: Avoiding a risk also gives up the return. Compare options against the company's risk appetite and strategy.

Worked examples

Example 1

Kavya Textiles, a listed manufacturer, buys 70% of its cotton from one overseas supplier. Last month the supplier's country announced export controls. Identify the source, cause and effect of this risk and recommend a TARA response. (8 marks)

Show the solution

Source: the single overseas supplier and its country's political and regulatory environment. This is an external source, with dependence on one supplier as an internal weakness.
Cause: the announced export controls could stop or limit cotton shipments, or raise prices.
Effect: production delays, missed customer orders, higher costs and lost sales. Because 70% of cotton comes from this supplier, the effect on output could be high.
Assessment: likelihood is now medium to high, since controls have been announced. Impact is high. This makes it a priority risk.
Responses: Avoid by ending use of this supplier would remove the exposure but may be costly and slow. Transfer through trade credit or supply disruption insurance may help with losses but does not secure cotton. Accept is not suitable given the high impact.
Recommendation: Reduce by qualifying two or more alternative suppliers in different countries, holding a buffer of cotton stock, and agreeing flexible contracts. Consider insurance for residual loss. Assign ownership to the procurement director and report progress to the risk committee.
Professional skills: note that the scale of the controls is still unclear, so the board should challenge assumptions and review the plan as facts emerge.

Answer: Source: single overseas supplier and its country's regulation. Cause: export controls. Effect: supply disruption, higher costs and lost sales. Recommended response: Reduce, through supplier diversification and buffer stock, with insurance as a partial Transfer. Assign an owner and monitor.

Example 2

Explain how a risk register helps the board of a company and describe the information it should contain for one risk: a data breach at an online retailer. (6 marks)

Show the solution

Purpose: a register gives the board one record of the main risks, how serious they are, what is being done and who is responsible. It supports prioritisation, accountability and regular review.
Risk description: customer data stolen through a cyber attack on the retailer's website.
Source: external attackers, combined with internal weaknesses such as weak access controls or unpatched software.
Cause: a successful attack that exploits a vulnerability.
Effect: regulatory fines, legal claims, loss of customer trust, lost sales and remediation costs.
Likelihood and impact: for example likelihood medium and impact high, giving a high rating. State the scale used.
Response: Reduce through encryption, access controls, testing and staff training. Transfer part through cyber insurance. Do not Accept, given the impact.
Owner and status: for example the chief information officer, with the date of the next review and progress on controls.

Answer: A risk register gives the board a ranked, owned and regularly reviewed record of risks. For the data breach, record the description, source, cause, effect, likelihood and impact rating, TARA response (mainly Reduce, with partial Transfer), owner and status.

Exam tips

Always use scenario facts. A risk named with the company's own detail earns more than a generic one.
Show the source, cause and effect chain when asked to identify or analyse a risk.
For TARA, name the action, justify the choice and mention a cost or drawback. A one-word label earns little.
Link responses to risk appetite and strategy. The board decides what level of risk is acceptable.
Use the professional skills marks: prioritise the key risks, question assumptions and write in a form the board can use, such as a short memo or table.

Practice questions from Identification, assessment and measurement of risk

Risk Models and Frameworks: Cause, Effect and Sources: frequently asked questions

What does TARA stand for in ACCA SBL?

TARA stands for Transfer, Avoid, Reduce and Accept. These are the four basic responses to a risk. Choose one by weighing likelihood, impact, cost and the company's risk appetite.

What is the difference between risk and uncertainty?

Risk is where outcomes can differ from expectations and you can usually estimate likelihood and impact. Uncertainty is where outcomes are unclear and reliable probabilities are hard to assign. In SBL, treat it as a matter of degree, not a strict divide.

What should a risk register include?

A typical register lists the risk, its source, likelihood, impact, a rating, the chosen response, an owner and its status. Layouts vary, so state the columns you use. A response and an owner are the parts students most often leave out.

How do I tell the source of a risk from its cause?

The source is where the risk originates, such as a supplier or a regulator. The cause is the event or condition that triggers it, such as a supplier failing. The effect is what then happens to the business.

Can I use a table for a risk register answer in the exam?

Yes, if the requirement asks for it or it helps you present clearly. Keep entries short and tied to the scenario. Add a brief explanation below it so you earn marks for analysis, not only for listing.