Strategic Business Leader · Managing, monitoring and mitigating risk

Risk Management Process and Risk Assessment for ACCA SBL

Updated 11 October 2026 · Fact-checked

The risk management process identifies risks, assesses each by likelihood and impact, profiles them, chooses a response, then monitors and reports. A risk register records the results. Risk appetite, set by the board, guides how much risk the organisation accepts. In SBL, you apply these steps to the case scenario.

Understand Risk Management Process and Risk Assessment

A risk is the possibility that an outcome differs from what the organisation expects. It can be a threat (loss) or an opportunity (gain). In SBL, you mostly deal with threats, but a good answer notes that risk-taking is also needed to create value.

The risk management process is a cycle, not a one-off task. You identify risks, assess them, decide a response, put controls in place, then monitor and report. Then you go round again, because the business and its environment change. The board is responsible for the process. Managers run it day to day.

Assessment looks at two things. Likelihood is how probable the event is. Impact (or severity) is how much damage it does if it happens. A risk that is likely but trivial needs less attention than one that is unlikely but could destroy the business. Combining the two lets you rank risks and put effort where it matters. You can show this on a risk profile (a heat map or likelihood-impact grid).

A risk register is the working record. For each risk it usually shows a description, the cause, an owner, likelihood and impact ratings, current controls, the planned response and the residual risk. Inherent risk is the risk before controls. Residual risk is what remains after controls.

Risk appetite is the amount and type of risk the organisation is willing to take to achieve its objectives. Risk tolerance is the acceptable variation around a specific objective or limit, so it is more detailed and often measurable. Appetite is the broad stance. Tolerance is the limit you can monitor. Risks that sit outside appetite need a response such as reduce, transfer or avoid.

Key rules to remember

Risk process cycle: Identify → Assess → Profile → Respond → Monitor and report → repeat; Use this as the structure for any process question. The cycle repeats because risks change.
Risk rating (scoring): Risk score = Likelihood score × Impact score; A common scoring method, not a fixed rule. For example, likelihood 4 × impact 5 = 20. State the scale you use, because ACCA does not prescribe one.
Expected loss: Expected loss = Probability of event × Financial impact; Use only when you have a probability and a money figure. It ignores non-financial effects and rare, severe events, so say so.
Residual risk: Residual risk = Inherent risk − Effect of controls; This is a conceptual relationship, not an arithmetic one. Controls reduce, but rarely remove, risk.
Appetite vs tolerance: Appetite = broad level of risk accepted. Tolerance = acceptable variation from a specific target or limit.; Appetite is set by the board. Tolerance turns it into measurable limits.

How to solve Risk Management Process and Risk Assessment questions

Use this method for any SBL task on risk assessment, risk registers or appetite. Tie each point to the scenario.

1Read the requirement and note the verb. 'Assess' needs a judgement. 'Identify' needs a list. 'Recommend' needs a conclusion.
2Identify the risks from the scenario facts. Group them, for example strategic, operational, financial, compliance and reputational. Quote the evidence.
3Assess each key risk for likelihood and impact. Explain why, using scenario facts, and use a simple scale such as high, medium or low.
4Profile the risks. Place them on a likelihood-impact grid, or rank them, and state which need most attention.
5Compare the risks with the organisation's risk appetite and tolerance. Say which sit outside them.
6Recommend a response for each priority risk, such as reduce, transfer, avoid or accept, with a named owner and a control.
7Say how the risk will be monitored and reported, for example through the risk register, key risk indicators and board review.
8Finish with a clear recommendation or conclusion in the format asked, for example a briefing note, to earn professional skills marks.

Quickest way: Likelihood-impact triage in five lines

When to use it: Use this when you have little time and the requirement asks you to assess or prioritise risks from a scenario.

Underline the risk facts in the scenario as you read.
List four to six risks, each in a short phrase.
Mark each as H, M or L for likelihood and for impact, with a one-line reason.
Rank them. High-high risks come first, then high impact with low likelihood.
Write one response and one owner for each of the top risks, then add a sentence on appetite.

Common mistakes in Risk Management Process and Risk Assessment

Listing generic risks that are not in the scenario.
Students memorise a list of risk types and write it out.
Fix: Use each category only if the case gives evidence. Quote the fact, then explain the risk it creates.
Rating risks without explaining why.
Writing 'high' feels like an answer.
Fix: Give a reason for each rating, linked to a scenario fact such as a supplier dependence or a past incident.
Mixing up likelihood and impact, or ranking on only one.
Students focus on the risk that sounds scariest.
Fix: Always assess both. A rare event with severe impact still needs a response, such as insurance or a continuity plan.
Treating risk appetite and risk tolerance as the same thing.
The terms sound alike and are often used loosely.
Fix: Define appetite as the broad level of risk the board accepts, and tolerance as the measurable limit around an objective.
Stopping at assessment and giving no response or monitoring.
The requirement mentions assessment only, so students stop early.
Fix: Add a brief response and monitoring point. It shows commercial awareness and often scores marks.
Using expected loss as the only measure.
It gives a neat number.
Fix: Add non-financial effects such as reputation, safety and regulatory action, and note that probabilities are estimates.

Worked examples

Example 1

Zentra Ltd has a single factory that makes 80% of its output. A recent survey says the factory is in a flood-risk area. Management estimates a 5% chance of a flood in any year, with a loss of $4,000,000 if it happens. The board says it has a low appetite for risks that threaten continuity. Assess the risk and recommend a response.

Show the solution

Identify the risk: loss of production through flooding, linked to the fact that one factory makes 80% of output. This is an operational risk with strategic consequences.
Assess likelihood: estimated at 5% a year, so low.
Assess impact: $4,000,000 of loss, plus lost sales, customer damage and possible reputational harm. This is high.
Expected loss = 5% × $4,000,000 = $200,000 a year. This is a guide only. It understates the real effect because it ignores non-financial damage and the fact that a flood is a rare but severe event.
Profile: low likelihood, high impact. It belongs in the upper-left area of the grid and cannot be ignored.
Compare with appetite: the board has a low appetite for continuity risk, so the exposure is outside appetite.
Respond: reduce the risk with flood defences, and transfer part of it through property and business interruption insurance. Add a business continuity plan and consider a second production site in the longer term.
Monitor: record in the risk register with an owner, such as the operations director, and review flood warnings and insurance cover at least annually.

Answer: The risk is low likelihood but high impact. Expected loss is $200,000 a year (5% × $4,000,000), but this understates the exposure. It is outside the board's low appetite for continuity risk, so Zentra should reduce it with defences and a continuity plan, transfer part through insurance, and monitor it through the risk register.

Example 2

Explain the difference between risk appetite and risk tolerance, and explain how a risk register helps the board of Kavari plc, a retailer, manage risk.

Show the solution

Define risk appetite: the amount and type of risk the board is willing to take to achieve its objectives. For Kavari, the board might accept moderate risk on opening new stores but low risk on product safety.
Define risk tolerance: the acceptable variation around a specific objective. For example, store openings may be allowed to overrun budget by no more than 10%.
State the link: appetite is the broad stance. Tolerance turns it into limits that managers can measure and report against.
Explain the register: it records each risk with its cause, owner, likelihood and impact rating, controls, response and residual risk.
Show the benefits: it gives the board one view of all risks and allows ranking. It assigns ownership, so someone is accountable, and it shows where residual risk exceeds appetite.
Show the ongoing use: updating the register at each review shows changes in risk and supports reporting to the audit or risk committee.
Conclude: used together, appetite and register let the board see which risks need action and check that action is working.

Answer: Risk appetite is the broad level and type of risk the board accepts. Risk tolerance is the measurable limit of acceptable variation around a specific objective. The register records and ranks risks, assigns owners and shows residual risk against appetite, so the board can decide where to act and monitor progress.

Exam tips

Always tie risks to scenario facts. Generic lists earn few marks, but quoted evidence plus analysis scores well.
Write the likelihood and the impact separately for each risk, and give a reason for each.
Use the board's stated appetite from the case when recommending responses. If none is given, say what you assume.
Keep numbers simple. State that probabilities are estimates and that expected loss ignores non-financial effects.
Present the answer in the requested format, such as a report or briefing note, with a clear recommendation to earn professional skills marks.

Practice questions from Managing, monitoring and mitigating risk

Risk Management Process and Risk Assessment in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Risk Management Process and Risk Assessment: frequently asked questions

What is the difference between risk appetite and risk tolerance?

Risk appetite is the broad amount and type of risk the board is willing to take to meet its objectives. Risk tolerance is the acceptable variation around a specific target or limit. Tolerance is usually measurable, so it can be monitored.

How do I assess likelihood and impact in SBL?

Rate each risk for how probable it is and how serious the effect would be. Use a simple scale such as high, medium and low, and give a reason from the scenario for each rating. Then rank the risks and prioritise those with high impact or high likelihood.

What goes in a risk register?

A typical register shows the risk description, cause, owner, likelihood and impact ratings, existing controls, planned response and residual risk. ACCA does not prescribe a format, so state what you include. The register is reviewed and updated regularly.

What is the difference between inherent and residual risk?

Inherent risk is the level of risk before any controls or responses. Residual risk is what remains after controls are applied. Residual risk is compared with appetite to decide whether more action is needed.