With such a wide-ranging field, it is almost impossible to develop an all-inclusive definition, one that will apply equally well to all areas of industry and commerce. But broadly speaking, it embodies a style of management that seeks first to determine and then either to minimise or control tangible risks such as mechanical or systems failure, security and fire. Alternatively, it attempts to enhance the benefits from speculative risks such as financial or commercial investment.

Risk management involves two distinct but inseparable components:

First, we have to identify and quantify risks. Unless we do so, have no means of deciding if a risk is worth taking or which of a number of courses of action offers the greatest chance of success. This is part of the risk assessment stage and is seldom a simple process, not least because the methods we use and the form in which we need the information will depend very heavily on the nature of our business.

Second, a business environment has to exist that makes risk analysis as integral part of its operation and adopts a positive, proactive attitude to generating and using eth information. This is the essence of the risk management phase.

These two halves must be treated as one single requirement if the overall process of risk management is to succeed. From an organisational standpoint, a ‘risk assessment’ unit might well exist as a distinct department but its whole ethos – its way of thinking about risk so as to avoid it, or control it, or seek maximum benefit from it – needs to permeate the management function throughout the entire organisation.

It is impossible in a work of this size to cover allaspects of risk management for every type of enterprise. Equally, this is not a course on, for example, statistics or the techniques of analysing the worth of a financial investment. But what we do aim to cover is the underpinning basis of the subject, to introduce its application within a range of enterprises and to set the scene for further study of risk management within the reader’s particular business sector or technology. Thus we begin with a discussion of the perception, terminology and nature of risk before moving on to summarise some of the many approaches that are used to identify and quantify it. Then we look at the culture of management and the organisational environment necessary for successful risk management. Finally, we end with a reference to some high profile events where, in hindsight, risk management was clearly not as much in evidence as it might have been.