The risk management strategy explains how the organisation frames, assesses, responds to and monitors risk. It makes assumptions, constraints, priorities, appetite and tolerance explicit so different teams can make consistent decisions.
This section covers the strategy itself, relevant international guidance and the three tiers connecting leadership, business processes and information systems. Use it to define who decides, which criteria apply and how changing conditions are reviewed.