Risk Management Policy

Purpose

This policy sets out how Towerblock Radio CIC identifies, assesses, manages and monitors risks to the organisation, its people and its activities.

Scope

This policy applies to all risks facing Towerblock Radio CIC, including operational, financial, governance, safeguarding, reputational, legal, compliance, technology and project risks.

Definitions

• Risk means the effect of uncertainty on objectives, measured in terms of likelihood and impact.
• Risk register means the formal record of identified risks, assessments and mitigation actions.
• Risk owner means the person responsible for managing a specific risk.
• Risk appetite means the level of risk the board is willing to accept.

Responsibilities

The board is responsible for the risk management framework, approving the risk register and reviewing risks at each meeting. The Operations Lead maintains the risk register. Risk owners manage their assigned risks.

Policy Statement

Towerblock Radio CIC manages risk proactively and systematically to protect the organisation, its people, its community and its assets, and to support the achievement of its mission and strategic objectives.

Detailed Procedures

Risk identification

Risks are identified through board and staff discussion, incident reports, funder and regulator feedback, external environment scanning, project debriefs and an annual risk workshop.

Risk assessment

Each risk is assessed for likelihood (1 rare to 5 almost certain) and impact (1 negligible to 5 catastrophic). Inherent risk is likelihood x impact before controls. Residual risk is likelihood x impact after controls.

Risk matrix

| Impact \ Likelihood | Rare (1) | Unlikely (2) | Possible (3) | Likely (4) | Almost Certain (5) | |---|---|---|---|---|---| | Catastrophic (5) | 5 | 10 | 15 | 20 | 25 | | Major (4) | 4 | 8 | 12 | 16 | 20 | | Moderate (3) | 3 | 6 | 9 | 12 | 15 | | Minor (2) | 2 | 4 | 6 | 8 | 10 | | Negligible (1) | 1 | 2 | 3 | 4 | 5 |

Green (1-6): low risk, monitor. Amber (7-12): medium risk, mitigate. Red (13-25): high risk, escalate to board.

Risk response

Responses include avoid (change the activity to eliminate the risk), reduce (implement controls), transfer (insurance), and accept (residual risk within appetite).

Risk appetite

The board has a low risk appetite for safeguarding, financial, legal and reputational risks, and a moderate risk appetite for operational and innovation risks.

Reporting Process

The risk register is reviewed at every board meeting. The board receives a risk summary at each meeting.

Compliance Requirements

• Companies Act 2006.
• Community Interest Company Regulations 2005.
• Charity Governance Code (best practice).
• Health and Safety at Work etc. Act 1974.

Monitoring

The risk register is updated at every board meeting. An annual risk review workshop is conducted.

Review Cycle

This policy shall be reviewed annually.

Version Number

Version 1.0

Approval Section

Approved by: Towerblock Radio CIC Board Date: July 2026 Next review: July 2027

Related Policies

• Risk Register
• Business Continuity Plan
• Safeguarding Policy
• Finance Controls Policy

Website URL slug

/policies/risk-management-policy

Meta Title

Risk Management Policy | Towerblock Radio

Meta Description

Towerblock Radio CIC's risk management policy covering risk identification, assessment, response, the risk register and board oversight, aligned with Charity Governance Code best practice.

Suggested menu category

Governance

Suggested search keywords

risk management, risk register, risk assessment, risk appetite, Charity Governance Code, governance