Skip to content

ACCA Strategic Professional · Strategic Business Leader

Managing, Monitoring and Mitigating Risk for ACCA SBL

Managing, monitoring and mitigating risk is the SBL chapter on how an organisation identifies, assesses, responds to and tracks risk. You solve questions by naming the risk, rating likelihood and impact, choosing a response (transfer, avoid, reduce or accept), then applying it to the case scenario with clear advice.

What this chapter covers

This chapter covers the full life cycle of risk in an organisation. You start with the risk management process and how risks are assessed. You then look at the four standard responses, the types of risk a business faces, and the culture and roles that make risk management work. The last part covers monitoring through internal control, recognised frameworks, and planning for disruption through business continuity and crisis plans.

In SBL, the chapter is rarely examined as pure theory. The case study gives you a business with exposures, and a task asks you to assess risks, advise the board, or review how risk is governed. You must pick the risks that matter in that scenario, not list every risk you know.

The chapter links closely to the rest of the paper. Governance and the role of the board set who owns risk. Strategy and strategic choices create risk, so every option you recommend needs a risk view. Change, technology, data and ethics all produce risks you can assess using the same process. Leadership and professional skills marks reward you for advice that is commercial and clearly communicated.

Risk appears in almost every SBL case, either as a stated task or as a point that strengthens a recommendation on strategy, governance or change. Candidates who can assess risk quickly, link it to the scenario and suggest practical responses score well on both technical and professional skills marks. Because the same method works for any business, this chapter gives a reliable return on study time and improves your answers in other chapters too.

Managing, monitoring and mitigating risk: topics in the order to study them

  1. 1Risk Management Process and Risk AssessmentIt sets the basic method of identify, assess, respond and monitor that every later topic builds on.
  2. 2Risk Responses: TARA FrameworkOnce you can rate a risk, you need the four responses to decide what to do about it.
  3. 3Types of Risk Faced by OrganisationsIt gives you the categories to spot risks in a case scenario and to apply the process and responses to real examples.
  4. 4Risk Culture, Roles and ResponsibilitiesIt explains who owns risk and how behaviour in the organisation affects whether the process works.
  5. 5Monitoring Risk and Internal Control SystemsControls are how responses are put into practice and checked, so it follows once you know roles and responses.
  6. 6Frameworks and Standards for Risk ManagementFrameworks make more sense after you know the process, culture and controls they organise.
  7. 7Risk Mitigation Through Business Continuity and Crisis PlanningIt covers planning for severe disruption, which is easiest to learn last as it draws on all earlier ideas.

How to prepare Managing, monitoring and mitigating risk

Treat this chapter as a method you apply to cases, not a set of notes to memorise. Practise on scenarios from the start.

  1. Learn the risk management process as a sequence and be able to write it in your own words in under a minute.
  2. Build a simple likelihood and impact view of risk and practise rating risks from short case extracts, giving a reason for each rating.
  3. Memorise the four TARA responses and, for each, write two realistic business examples so you can match a response to a risk.
  4. Make a checklist of risk types and practise spotting them in the pre-seen and exam material, noting which are most significant to the business.
  5. Read past SBL cases and list who owns risk, what controls exist and where culture or governance is weak, then write advice for the board.
  6. Write timed answers to risk tasks. Each point should state the risk, apply it to the scenario, and give a clear recommendation.
  7. Review your answers for professional skills such as a clear structure, a balanced view and advice a board could act on.

Common mistakes in Managing, monitoring and mitigating risk

  • Listing risk types without applying them to the scenario.

    Fix: Choose the two or three risks most important to this business and explain the specific effect on it.

  • Naming a TARA response without justifying it.

    Fix: State why the response suits the likelihood, impact and cost, and what the business gives up by choosing it.

  • Assuming insurance or transfer removes the risk entirely.

    Fix: Note what remains, such as reputation damage, excluded losses or the cost of cover.

  • Ignoring culture and governance when advising on controls.

    Fix: Say who owns the risk and how tone from the top, incentives and reporting lines support or undermine controls.

  • Giving generic framework description instead of advice.

    Fix: Use the framework only to support a recommendation for this organisation, in a few focused points.

  • Treating business continuity as only an IT backup.

    Fix: Cover people, premises, suppliers, communication and decision-making as well as systems.

Last-day revision: Managing, monitoring and mitigating risk

  • The risk process: identify, assess, respond, monitor and report, then repeat.
  • Assess risk by likelihood and impact, and say which risks need attention first.
  • TARA means transfer, avoid, reduce, accept.
  • Transfer shifts the financial effect, for example by insurance or contract, but not always the responsibility.
  • Avoid means not doing the activity, which may also lose the reward.
  • Reduce lowers likelihood or impact through controls; accept is a conscious choice when the risk is within tolerance.
  • Link every risk to the scenario and name the business effect.
  • Risk culture is shaped by tone from the top, incentives and how people behave when things go wrong.
  • The board is responsible for risk oversight; management runs the process day to day.
  • Internal controls and monitoring check that responses work and reveal new risks.
  • Frameworks give a structured approach, but you must tailor advice to the case.
  • Business continuity plans cover recovery of operations; crisis plans cover leadership and communication during a major event.

Managing, monitoring and mitigating risk practice questions

Managing, monitoring and mitigating risk in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Managing, monitoring and mitigating risk: frequently asked questions

How much of SBL is about risk?

Risk is not a separate section of the paper. It can be a direct task or part of advice on strategy, governance, change or technology. Be ready to apply it to any case.

What is the TARA framework?

TARA stands for transfer, avoid, reduce and accept. These are the four basic responses to a risk. In an answer, you pick one and explain why it fits the scenario.

How do I score professional skills marks on risk questions?

Structure your answer clearly, show analysis and scepticism, and give commercial advice that suits the audience. Aim for a prioritised, balanced recommendation rather than a long list.

Do I need to learn a specific risk framework in detail?

You should understand the purpose and main ideas of the recognised frameworks. Marks come from applying them sensibly to the case, not from reciting their structure.