Risk Management Policy

Aug 31, 2026

Risk Management Policy defines how NICE manages uncertainty to protect and advance organizational objectives. It sets out risk management principles, including identifying strategic and operational risks, assessing qualitative or quantitative impact, and categorising risks for evaluation. The policy explains how risk appetite guides escalation, de-escalation, and decision-making, and assigns clear responsibilities for risk owners and leads. It also specifies governance through oversight, annual reporting, audit involvement, and registers for projects, supported by appendices for quantifying and monitoring risks and version control.

LanguageEnglish

CategoryGeneral

FormatDOCX

Pages15

Reading Time5 min

AccessFree to download

Introduction

Risk management

Risk identification and assessment

Categorising risk

Risk appetite

Oversight

Annual report governance statement and the role of audit

Review

Appendix A – Quantifying and monitoring risks

Appendix B – Risk register

Appendix C – Version control sheet

Risk Management Policy Responsible Officer – Director, Finance Author – Corporate office Date effective from May 2017 Date last amended May 2024 Review date September 2026 Contents Introduction 3 Risk management 3 Risk identification and assessment 3 Categorising risk 4 Risk appetite 5 Oversight 6 Annual report governance statement and the role of audit 7 Review 8 Appendix A – Quantifying and monitoring risks 9 Appendix B – Risk register 12 Appendix C – Version control sheet 13 Introduction Risk is the uncertainty surrounding events and their outcomes that may have an impact on NICE. All our activities carry some risk, arising either from potential threats or the non-realisation of opportunities which may harm, prevent, hinder or interfere with the achievement of our objectives. Risk is inherent in every activity and this policy sets out how NICE will manage risks to ensure a balanced approach to opportunity and risk. It explains the approach to risk management; defines risk and how it is assessed, evaluated and escalated in the context of NICE’s risk appetite; and documents roles and responsibilities for the management of risks. Risk management Risk management enables organisations to evaluate and respond to risks and opportunities and seeks to manage the impact of uncertainty by increasing the probability of success and reducing the likelihood of failure. Effective risk management involves evaluating the uncertainties and implications within options and managing impacts once choices are made. It provides a process for identifying risks around new, proposed and current business activities, and involves the categorisation and evaluation of each risk and the application of management controls to mitigate the risk. The evaluation is based on a judgement of the likely impact if no further action is taken, combined with an assessment of the likelihood of the risk re-occurring. Risk management should be both an integral part of all organisational activities to support decision-making in achieving objectives and embedded within the culture of the organisation. Risk identification Like all organisations, NICE faces risks, actual and theoretical, that range from the trivial to the existential. This policy is intended to address both the strategic risks which arise from our strategic ambitions and from the potential external threats to NICE from the developments in our operating environment, and the operational risks to our objectives and plans to manage and deliver our operational activities. Risk assessment is a qualitative or quantitative evaluation of the nature and magnitude of risk to our objectives and planned activities. The evaluation is based upon known vulnerabilities and threats and considers the likelihood of the threats being realised and their impact on our work. The Executive Team (ET) will ensure the strategic risks that may affect delivery of NICE’s strategy are identified, assessed and included in the strategic risk register which is reviewed by the Audit and Risk Assurance Committee and Board. ET will continually review the strategic risks to ensure they remain relevant as the operating environment changes and recommend changes to the Audit and Risk Assurance Committee and Board. In identifying the strategic risks ET will also consider risk interdependencies with Department of Health and Social Care (DHSC) Arms-Length Bodies (ALBs), and other key partners. This will include the other ALBs NICE is dependent on to deliver its priorities. Directors will also ensure that risks in their directorate, which are not strategic in nature, are identified, assessed and incorporated in the operational risk register when they have a potential cross-organisational impact. Directors are required to include a risk assessment in ET and Board reports where there is a substantive new development proposed or substantive change to existing activities. Risk registers ar

FAQs

What does the policy mean by “risk” and how does it relate to NICE objectives?

Risk is described as uncertainty about events and outcomes that may affect NICE, including threats that could harm objectives and failures to realize opportunities. The policy aims to manage that uncertainty so objectives can be achieved with a balanced approach.

How are risks identified and assessed under the policy?

Risk identification covers both strategic risks from strategic ambitions and external threats, and operational risks tied to objectives and delivery. Risk assessment is a qualitative or quantitative evaluation of likelihood and impact, informed by known vulnerabilities and threats.

Who is responsible for managing risks, and what are the key actions for risk owners?

Each risk has a single nominated risk owner responsible for coordinating the overall response. This includes setting current and target ratings and tolerance in line with the risk appetite, checking whether management is effective, and deciding whether escalation or de-escalation is needed.

Aug 31, 2026

Upload by Nguyễn Văn Học