Practical

Risk Management for

Startups

Practical Step by Step HandBook

Overview Prepare Execute Review Improve

A comprehensive, no-nonsense guide for new

risk managers and company leaders
navigating the complexities of risk in fast-
growing organizations. Learn to protect your
company while enabling smart growth.
Prabh Nair

Prabh Nair
The Core Truth About Risk
Management
Risk management isn't about eliminating risk4it's about making informed decisions about which
risks to take. Think of it like driving a car: you don't avoid driving because it's risky, you don't drive
recklessly ignoring risk, but you drive carefully, wear your seatbelt, and carry insurance. Your job is to
help the company "drive" toward its goals without crashing.

Prevents Surprises Enables Smart Risk-Taking

You see problems coming before they hit, Take calculated risks that drive growth while
giving leadership time to respond effectively avoiding catastrophic mistakes

Protects the Company Improves Decisions

Shield against bankruptcy, lawsuits, and Leadership knows exactly what they're
reputational damage that could end the getting into before committing resources
business

What Risk Management Is NOT

NOT a bureaucracy that slows everything Effective risk management is a strategic
down enabler, not a roadblock. It creates the
NOT saying "no" to everything confidence and clarity leadership needs to
move fast while staying safe. When done right,
NOT writing policies nobody reads
it accelerates decision-making rather than
NOT a compliance checkbox exercise
hindering it.

Prabh Nair
Your First 30 Days: The Assessment
Phase
Your first month is critical for building a solid foundation. Focus on understanding your company, its
risks, and culture to gain credibility and knowledge before implementing frameworks.

01 02 03

Week 1: Understand Week 2: Document Week 3-4: Quick Risk

Your Company Current State Assessment
Interview the CEO and Map existing risk management Conduct a workshop with key
leadership. Identify their processes and tools across stakeholders to identify,
primary concerns and initial risk teams. Identify gaps and categorize, and prioritize the
list. ownership. top 20 risks by severity.

The Questions That Matter

These five questions will unlock everything you need to know from leadership. Write down every
answer verbatim4these are your priorities speaking directly to you.

1 What keeps you up at night?

This reveals leadership's personal risk list and key priorities.

2 What could kill this company in the next 12 months?

Pinpoint critical risks (e.g., bankruptcy, cyberattack, major lawsuit) demanding immediate
attention.

3 What big opportunities are we missing because of risk concerns?

Understand where calculated risk-taking can unlock growth.

4 What's happened in the past that we don't want to repeat?

Learn from past incidents to build controls and prevent recurrence.

5 How much risk can we actually afford to take?

Initiate the risk appetite conversation based on financial capacity and leadership tolerance.

Prabh Nair
Week 1 Deep Dive: Walking the Floor
During your first week, engage with every department. The most valuable insights into real risks
come from the people doing the work daily. They know what's fragile, what's breaking, and what's
being held together with hope.

Operations Team
Ask: "What breaks often? What's held together with duct tape?"

Technology Team
Ask: "What systems worry you? What happens if AWS goes down?"

Sales Team
Ask: "What customer complaints do you hear? What are we promising we can't deliver?"

Finance Team
Ask: "Where's the money tight? What could surprise us financially?"

Compliance Team
Ask: "What regulations are we close to violating?"

Real Example: A fintech CEO told me their top fears were: RBI shutting them down (regulatory), a
big fraud wiping out cash (operational), competitors stealing their tech team (people), and
running out of money before next funding (financial). Boom4there's the top 4 risks to manage.
Simple as that.

Prabh Nair
Map Your Company's Critical
Elements
Effectively managing risk starts with identifying what you're protecting. This involves recognizing
core elements that, if compromised, could severely damage your organization. Focus on what you
absolutely cannot afford to lose or have interrupted.

Critical Assets Critical Processes

Data: Customer information, intellectual Customer onboarding and support
property, financial records, strategic plans. Product development and deployment
Systems: Core operational platforms, cloud Sales pipeline and revenue generation
infrastructure, CRM, ERP, production
Financial reporting and compliance
environments.
IT incident response and business
People: Key leadership, specialized
continuity
technical talent, sales force, institutional
knowledge.
Money: Cash flow, access to capital,
investment portfolios, revenue streams.
Reputation: Brand trust, market standing,
customer loyalty, public perception.

Once mapped, prioritize risks and allocate resources to protect these critical areas. For fintech
companies, paramount processes often include:

Customer Onboarding
Smooth, secure, and compliant process for new users.

Payment Processing
Secure and reliable execution of all financial transactions.

Fraud Detection
Systems to identify and prevent fraudulent activities.

Regulatory Reporting
Accurate and timely submissions to financial authorities.

Fund Transfers
Secure and efficient movement of funds between accounts.
The Risk Workshop: Getting Everyone
Aligned
In weeks 3-4, run a structured workshop to identify and prioritize risks. Get 10-15 people in a room
for 2 hours: leadership (CEO, CFO, CTO), department heads from all key functions, and front-line
experts who know where the real problems are. This workshop creates buy-in and surfaces risks
you'd never discover alone.

Identify Risks Group & Categorize

30 minutes: Everyone writes risks on sticky 45 minutes: Stick notes on wall. Group into
notes. One risk per note. Be specific. No idea categories: Strategic, Financial, Operational,
is stupid. You'll get 50-100 risks. Compliance, Technology, Reputational.

Prioritize Top 20 Assign Owners

30 minutes: Vote on severity. Could kill the 15 minutes: For each critical risk, someone
company = RED. Would seriously hurt = specific must own it. Not "everyone" or
YELLOW. Manageable = GREEN. Focus on RED "CEO"4an actual person accountable.
and YELLOW only.

Real Workshop Output Example

Here's what the top 10 risks looked like for a real fintech startup after their workshop. Notice how
each risk has a clear owner4this accountability is crucial for action.

# Risk Severity Owner

1 RBI regulatory violation ³ License revoked RED Chief Compliance Officer

2 Major data breach ³ Customer data stolen RED CISO

3 Payment system down >4 hours YELLOW CTO

4 Key engineer quits, takes team YELLOW Head of Engineering + HR

5 Cash runway <3 months before funding RED CFO

6 Fraud ring drains ¹10+ crores RED Head of Risk & Fraud

7 AWS Mumbai region failure YELLOW CTO

Understanding Risk Appetite,
Tolerance & Capacity
These three concepts confuse everyone, but they're actually simple when you break them down.
Think of them as a hierarchy: capacity is your hard limit, appetite is your strategic choice, and
tolerance is your specific threshold. Understanding these properly is the foundation for every risk
decision you'll make.

Risk Tolerance
Specific operational
thresholds and limits for
activities

Risk Appetite
Strategic level risk the
organization chooses to
accept
Risk Capacity
Absolute, hard limit of risk
the organization can bear

The Three Levels Explained

Risk Tolerance: The

Risk Appetite: The Lines
Risk Capacity: The Boundary Definition: Specific limits
Cliff Definition: How much risk for each risk. These are
Definition: How much risk are you willing to take? This measurable, trackable
can you survive? This is is strategic4a leadership thresholds.
mathematical, not opinion. decision.
Example: Maximum single
Example: Fintech with ¹50 Example: Same fintech loss: ¹2 crores. Monthly
crores cash, ¹8 crores leadership says: "We want fraud losses: <¹50 lakhs.
monthly burn. Cannot lose to grow fast. Willing to lose System downtime: <1 hour
more than ¹30 crores up to ¹5 crores on new per month. Regulatory
(would go bankrupt). initiatives (10% of capital). violations: ZERO.
Cannot have system down Accept 99% uptime. ZERO
>3 days (customers would tolerance for compliance
leave permanently). violations."

Prabh Nair
How to Set Risk Capacity
Risk capacity defines the absolute, non-negotiable limits your organization cannot exceed for
survival. It's a critical calculation, determining what *cannot* be lost or disrupted, marking the point
of no return.

Step-by-Step: Determining Financial Limits

Work with your CFO to calculate financial breaking points, analyzing your balance sheet and
projecting worst-case scenarios.

Identify Critical Resources 1

List current cash, credit lines, and
investment portfolios to determine
total liquid assets.
2 Calculate Burn Rate &
Runway
Determine monthly expenditure and
Define Absolute Loss 3 how long funds sustain operations
Thresholds without new revenue.

Pinpoint maximum single or cumulative

losses the company can absorb before
insolvency or failing critical obligations.

Step-by-Step: Determining Operational Limits

Beyond finances, critical operations also have hard limits. Define the maximum acceptable
disruption to core functions before irreversible damage.

Map Critical Processes 1

Identify core operational processes and
supporting systems (e.g., payment
processing, customer data, security).
2 Assess Disruption Impact
Quantify maximum acceptable
downtime or performance degradation
Establish Non-Negotiable 3 before existential threats like customer
Thresholds loss or regulatory fines.

Set clear, measurable limits for

operational disruptions, such as
"Payment processing < X hours
downtime" or "Customer data
compromise < Y minutes."
Risk Capacity Example: Fintech
Startup
To illustrate the critical concept of risk capacity, let's examine a practical example for a fintech
company. This involves identifying the absolute hard limits beyond which the organization cannot
survive, a cold, hard calculation conducted with financial and operational leaders.

Company Profile
Consider a growing fintech startup with the following financial standing:

Cash Reserves: ¹50 crores

Monthly Burn Rate: ¹8 crores

This profile gives the company an operational runway of approximately 6.25 months under current
conditions. We must now define the hard boundaries that, if crossed, would put the company in an
existential crisis.

Financial Capacity Limits Operational Capacity Thresholds

Collaborating closely with the CFO, we Beyond financial limits, critical operations
pinpoint the maximum financial loss the also have hard thresholds that, if breached,
company can absorb before facing cause irreversible damage. These define
insolvency or an inability to meet critical the maximum acceptable disruption to
obligations. This isn't a strategic choice but core functions.
a fundamental survival calculation.
System Downtime: Core payment
Maximum Cash Loss: The company processing systems cannot be down
cannot lose more than ¹30 crores of its for more than 3 days. Extended
cash reserves, as this would lead to downtime would cause customers to
bankruptcy. leave permanently, leading to
Regulatory Capital: Failure to maintain irreparable loss of trust and business.
minimum regulatory capital Major Data Breach: A significant data
requirements would lead to immediate breach resulting in widespread
operational suspension. customer data theft could lead to
severe regulatory fines, loss of licenses,
and complete brand reputation
collapse.

These identified limits 4 ¹30 crores in financial loss and 3 days of system downtime 4 represent the
company's absolute risk capacity. They are non-negotiable boundaries, the point of no return
beyond which the organization cannot survive.

Prabh Nair
Defining Your Risk Appetite
Statement
Risk appetite isn't something you guess4it requires a structured 3-hour workshop with your CEO,
CFO, CTO, COO, and Board members. This session will define how aggressive or conservative your
company wants to be across different risk categories. The output is a one-page statement that
guides every risk decision you make.

The Risk Appetite Framework

For each major risk category, choose your appetite level. This isn't theoretical4it directly impacts
how you operate.

Risk Averse
We avoid this risk type. Not worth it.

Example: Compliance risks in a fintech.

One violation could shut down the entire Risk Cautious
company. Zero tolerance. Over-invest in
We take minimal risk here. Very careful.
compliance if needed.
Example: Reputational risks. Fintech
equals trust, and trust is fragile. One
Risk Balanced major incident could permanently
We take calculated risks. Managed damage the brand.
carefully.

Example: Technology risks. Need to

innovate to compete, but not recklessly. Risk Seeking
Use proven tech for core systems, We embrace this risk to grow faster.
experiment for non-critical.
Example: Market risks. Try new products
quickly, even if some fail. Enter new
markets aggressively. Speed is
competitive advantage.

Prabh Nair
FinTech Innovators Inc.: Risk Appetite
Statement
This statement outlines our approach to risk across key categories, guiding decision-making.

Strategic Risk: SEEKING

Aggressive pursuit of growth and innovation, accepting higher failure probability for

1 breakthroughs.

Do's: Rapid prototyping, quick market entry, embrace disruptive tech.

Don'ts: Hesitate on opportunities, stick to legacy systems.

Financial Risk: BALANCED

Prudently manage capital for sustainable growth. Calculated risks, but avoid

2 jeopardizing solvency.

Do's: Diversified investments, active liquidity management, strategic debt leverage.

Don'ts: Speculative investments, excessive debt, exceed loss thresholds.

Operational Risk: CAUTIOUS

Prioritize stability and reliability in core operations, minimizing disruptions and
maintaining robust systems.
3
Do's: Heavy investment in resilience, cybersecurity, rigorous change management,
comprehensive BCPs.

Don'ts: Underinvest in security, delay upgrades, compromise controls for speed.

Compliance Risk: AVERSE

Zero tolerance for non-compliance. Regulatory integrity is paramount.

4 Do's: Proactively monitor regulatory changes, regular audits, mandatory staff training.

Don'ts: Cut corners on regulatory requirements, ignore red flags, operate in ambiguous
jurisdictions.

Prabh Nair
Setting Risk Tolerance Levels
Risk tolerance translates your appetite into specific, measurable thresholds. For each of your top 20
risks, you need exact numbers that define "acceptable," "warning," and "unacceptable." This is where
strategy becomes operations. These tolerances tell your teams exactly when to act.

The Traffic Light System

For every critical risk, define three zones. Make them specific enough that anyone can look at
metrics and know immediately what action to take.

GREEN: Acceptable YELLOW: Warning RED: Unacceptable

Risk is within tolerance. Risk is elevated. Investigate Risk breach. Immediate
Continue normal operations. immediately. Implement fixes escalation to CEO. Emergency
Monitor regularly but no within 48 hours. Escalate to risk response. Mandatory post-
special action needed. owner. mortem and action plan.

Example: System downtime Example: Downtime 30-60 Example: Downtime >60

<30 minutes per month. Failed minutes per month. Failed minutes per month. Failed
transactions <0.2%. transactions 0.2-0.5%. transactions >0.5%.
Risk Tolerance Examples by Category
Financial Risk Operational Risk
Green: Green:

Monthly cash burn < 80% of projected. Transaction errors < 0.1% per month.
Bad debt < 1% of total revenue. CS response time < 1 hr (avg).
Liquidity ratio > 1.5. Failed payment reconciliations <
¹10K/day.
Yellow:
Yellow:
Cash burn 80-95% of projected.
Bad debt 1-2% of total revenue. Transaction errors 0.1-0.2% per month.

Liquidity ratio 1.2-1.5. CS response time 1-2 hrs (avg).

Failed payment reconciliations ¹10K-
Red:
¹50K/day.
Cash burn > 95% of projected.
Red:
Bad debt > 2% of total revenue.
Transaction errors > 0.2% per month.
Liquidity ratio < 1.2.
CS response time > 2 hrs (avg).
Failed payment reconciliations >
¹50K/day.

Compliance Risk Technology Risk

Green: Green:

Zero non-material breaches. System uptime > 99.9% for critical

All regulatory reports on time. services.
Zero critical security vulnerabilities.
Yellow:
MTTR < 1 hr for major incidents.
1 non-material breach/quarter,
remediated within 72h. Yellow:

Minor delay in non-critical regulatory Uptime 99.5-99.9% for critical services.

report. 1-2 critical vulnerabilities, remediated
Red: within 24 hrs.

Any material breach. MTTR 1-4 hrs for major incidents.

Multiple non-material breaches Red:

(2+/quarter). Uptime < 99.5% for critical services.
Breach identified by regulator. >2 critical vulnerabilities or unpatched
Significant delay/failure of critical after 24 hrs.
regulatory report. Any data breach/loss/exposure.
MTTR > 4 hrs for major incidents.

Prabh Nair
The Four-Step Risk Management
Process

Once you have your framework set, you need a repeatable process for managing risks day-to-day.
This four-step cycle4Identify, Analyze, Evaluate, Treat4runs continuously. Some risks you'll cycle
through monthly, others quarterly. The key is discipline: follow the process systematically, and you'll
catch issues before they become crises.

Identify
Analyze
Find new risks and update
Assess likelihood and
existing ones. Monthly risk
impact. Use the risk matrix to
scans, incident reports,
rate each risk as Low,
employee feedback, industry
Medium, High, or Extreme.
news.

Treat Evaluate
Execute action plans. Assign Decide response strategy.
owners, set deadlines, track Avoid, Reduce, Transfer, or
progress weekly until risk is Accept based on risk rating
reduced to acceptable level. and business context.

Prabh Nair
Risk Identification & Analysis

Effective risk management starts with robust identification of potential risks, followed by systematic
analysis to prioritize and address them. This allows for proactive and informed decision-making.

Risk Identification Sources

Identify risks from various internal and external factors to understand potential threats and
opportunities, anticipating challenges before they escalate.

Internal Sources External Sources

Incident Reports & Logs Industry News & Market Trends
Internal Audit Findings Regulatory Updates
Employee Feedback Competitor Analysis
Performance Reviews & KPI Deviations Customer Feedback & Social Media
Project Post-Mortems Cyber Threat Intelligence
System Change Logs Economic & Geopolitical Developments
Financial Reporting Anomalies Supply Chain Disruptions

Monthly Risk Scanning Process

A regular "risk scan" is essential to keep your risk register current, identifying new risks and re-
evaluating existing ones based on the latest information.

Review Incidents & Scan for New & Update Risk Register &
Near Misses Emerging Risks Owners
Analyze past month's incidents Convene a cross-functional Formally add new risks with
and near misses to identify team to review internal updates provisional ratings and owners,
emerging risk patterns. and external developments, updating existing assessments
brainstorming potential new as needed.
risks.

Prabh Nair
Risk Analysis: The Risk Matrix
The Risk Matrix is a fundamental tool for prioritizing risks based on their potential impact and
likelihood, ensuring effective resource allocation. It categorizes risks by addressing two key
questions:

Likelihood: How probable is this risk? (e.g., Rare, Unlikely, Moderate, Likely, Almost Certain)
Impact: What would be the severity of consequences? (e.g., Insignificant, Minor, Moderate,
Major, Catastrophic)

By combining these two dimensions, the risk matrix assigns a rating (Low to Extreme) to guide
appropriate responses. The standard 5x5 risk matrix below illustrates this:

Insignifican Minor Moderate Major Catastrophi

t c

Almost Medium High Extreme Extreme Extreme

Certain

Likely Low Medium High Extreme Extreme

Moderate Low Medium High High Extreme

Unlikely Low Low Medium Medium High

Rare Low Low Low Medium Medium

Each rating level dictates specific priority actions:

EXTREME: Immediate Action HIGH: Urgent Management

Required Review
Posing a significant threat, these risks Requires urgent action and thorough
demand immediate attention. Senior review by management. A detailed action
management involvement and plan must be developed, executed, and
comprehensive mitigation strategies are regularly monitored to reduce risk.
essential.

MEDIUM: Planned Action & LOW: Monitor & Document

Monitoring Minimal immediate action is needed.
These risks require planned mitigation, Document and monitor periodically,
with designated owners, timelines, and considering low-cost mitigation if feasible,
regular monitoring as part of routine risk to prevent escalation.
management processes.

Prabh Nair
Risk Response Strategies:
After analyzing and rating risks, choose one of four core response strategies: Avoid, Reduce,
Transfer, or Accept. While reducing risks is common, mastering all four is crucial for effective risk
management.

AVOID: Don't Do REDUCE: Take TRANSFER: Let ACCEPT: Do

It Action Others Handle It Nothing
When: Risk too high, When: Most common When: Others can When: Risk is low, or
reward too low. (80% of risk manage it better or mitigation cost
management). cheaper. outweighs potential
Example: Avoid
loss.
markets with Example: Implement Example: Buy
impossible regulations encryption, train insurance (financial Example: Accept
or experimental core employees, create risk), outsource minor website bugs or
tech. This means not backups. Lower payments (operational low-cost office
performing the activity likelihood or impact to risk), use cloud outages. Always
creating the risk. acceptable levels. providers document the
(infrastructure risk). decision, who made it,
and why.

Decision Framework
Use this logic to choose your response strategy:

Is the risk EXTREME? 1

Must Avoid, Reduce, or Transfer. Never
accept without CEO/Board sign-off,
documented in writing.
2 Is the risk HIGH?
Should Reduce or Transfer. Accepting
HIGH risks requires executive approval
Is the risk MEDIUM? 3 with clear justification.
Evaluate: compare mitigation cost vs.
potential loss. Some you reduce, some
you accept. 4 Is the risk LOW?
Usually accept. Avoid wasting
resources unless mitigation is trivially
easy. Always document the decision.

Prabh Nair
Risk Treatment: Action Planning &
Execution
Effective risk management requires translating strategy into detailed action plans with specific
tasks, owners, deadlines, and budgets. This card outlines a structured approach for execution and
continuous tracking.

Anatomy of a Complete Risk Action Plan

RISK: Data Breach

Current Rating: EXTREME (Possible + Catastrophic)
Target Rating: HIGH (Unlikely + Major)
Owner: CISO
Budget: ¹80 lakhs
Timeline: 6 months
Review Date: July 31, 2025

Phased Action Plan

Month 1-2: Immediate Fixes

1 Deploy EDR on all endpoints (¹25L) - Raj - Feb 28 - 100% coverage
Implement MFA for all systems (¹5L) - Priya - Feb 15 - 100% users enabled

Month 3-4: Stronger Controls

2 Deploy SIEM for monitoring (¹30L) - Raj - April 30 - 95% log coverage
Conduct security training (¹8L) - HR+CISO - April 30 - 90% staff complete

Month 5-6: Build Resilience

3 Purchase cyber insurance (¹10L/year) - CFO - May 31 - ¹50Cr coverage
Create incident response plan (¹2L) - CISO - June 30 - Plan tested
Weekly Risk Status Reporting
Consistent and concise weekly status updates to leadership are vital for maintaining transparency
and ensuring timely action on identified risks. These updates should provide a snapshot of current
risk posture, progress on mitigation efforts, and highlight any emergent issues or blockers requiring
executive attention.

A well-structured report enables leadership to quickly grasp the overall risk landscape and make
informed decisions, without delving into excessive detail.

Project/Risk Area Status Key Progress & Blockers/Challenges Help Needed

Updates

Cloud Migration On Track Phase 1 completion None N/A

Initiative ahead of schedule.
Data transfer 80%
complete. Security
review initiated.

New Product At Risk Marketing materials Vendor A unable to meet Urgent: Need C-
Launch delayed due to original print deadlines for level intervention
vendor issues. Final print materials. Design with Vendor A for
design approval team overloaded with ad- revised timelines
pending. hoc requests. or penalty clauses.
Explore alternative
design agencies
for overflow.

Supply Chain On Track New supplier Minor delays in contract Legal team to
Resilience onboarding 50% finalization with Supplier prioritize Supplier
complete. B due to legal review B contract.
Contingency backlog.
planning document
drafted.

Cybersecurity At Risk Critical patch Legacy systems require Resource

Vulnerability deployment stalled significant manual allocation: Need
Patching on 15% of legacy intervention and testing additional
systems due to for patch deployment, dedicated IT
compatibility causing delays. personnel for
issues. legacy system
patching.

Employee Training On Track Mandatory Minor scheduling N/A

& Development compliance training conflicts for Q3 elective
90% complete. courses.
Leadership
workshop
scheduled.

This streamlined approach ensures that critical information is communicated effectively, allowing
for proactive risk management and strategic resource deployment.

Prabh Nair
Your Risk Management Toolkit
You don't need expensive GRC software when you're starting. A well-structured Excel file and
consistent processes will take you far. Here are the essential tools to get started immediately. Build
these simple systems first, prove value, then upgrade to sophisticated tools if needed.

Tool #1: The Risk Register

This is your central database. Track everything in one place. Start with Excel, graduate to a tool later.

Essential Columns Maintain It Weekly Share It Monthly

Risk ID " Description " Category Update every Monday. Add new Create executive summary.
" Likelihood " Impact " Rating " risks from scans. Update status Show top 10 risks with status.
Owner " Current Controls " on action plans. Mark Highlight new EXTREME risks.
Residual Risk " Response completed items. Archive old Report progress on mitigation.
Strategy " Actions " Target Risk risks. Keep it current or it Request decisions on accepted
" Due Date " Status " Last becomes useless. risks.
Reviewed

Tool #2: Risk Heat Map

Create a visual representation every month for leadership. Executives love visuals4they can see
priorities at a glance.

Tool #3: Risk Appetite & Tolerance Document

One-page statement that guides all decisions. Update annually or when strategy changes
significantly.

Tool #4: Incident Log

When things go wrong, capture lessons. Every incident is data for identifying risks you missed.

Date Incident Impact Root Cause Action Taken

Jan 15 Payment ¹15L lost AWS scaling failure Added

system down 2 transactions redundancy
hrs

Jan 22 Fraud ring ¹45L stolen Weak verification Enhanced

discovered KYC

Feb 3 Data exposure 500 records API Security

Your 30-Day Implementation
Roadmap
Implementing a robust risk management program doesn't have to be overwhelming. This
30-day roadmap provides a structured approach to build a solid foundation, establish
critical frameworks, and begin effective execution, setting you up for rapid initial
success.

01 02

Week 1: Foundation & Initial Week 2: Initial Mitigation &

Identification Reporting Setup
Focus on establishing core elements and Build on the foundation by outlining initial
identifying immediate priorities. responses and communication rhythms.

Establish Risk Register: Start a simple Develop High-Level Mitigation Plans:

Excel file to track risks. Draft actionable plans for your critical
Define Categories & Scales: Establish risks, focusing on immediate steps.
basic risk categories and consistent Set Up Weekly Reporting: Establish a
likelihood/impact scales. rhythm for brief weekly risk status
Identify Top 3-5 Critical Risks: Work check-ins with your core team.
with key stakeholders to pinpoint the Draft Risk Appetite Statement: Create
most pressing risks. a concise, one-page draft outlining
Assign Owners & Initial Controls: For your organization's risk appetite.
identified risks, assign owners and
document existing controls.

03 04

Week 3: Action & Learning Week 4: Refinement & Next

Begin active management and capture Steps
early lessons. Consolidate learnings, refine processes,
and prepare for continued progress.
Execute Initial Mitigation Actions:
Start implementing the defined Refine Risk Register & Processes:
mitigation steps for critical risks. Update your register and basic
Conduct First Internal Review: Hold processes based on the first few weeks'
your first informal risk review with experience.
relevant team members to discuss Prepare 30-Day Progress Update:
progress and blockers. Consolidate key insights and progress
Start Incident Logging: Implement a to share with leadership.
basic incident log to capture and learn Plan for Ongoing Management: Outline
from any events that occur. the next steps for continuous
improvement beyond this initial 30-day
sprint.

Prabh Nair
Final Advice for Risk Management
Success
Successful risk management is not about eliminating all risks, but about making informed decisions
to navigate uncertainties. It's a strategic tool that empowers growth rather than hindering it.
Embrace these core principles to cultivate a robust and effective risk management practice within
your organization.

1 Start Simple, Act Fast 2 Focus on Critical Risks

Don't get bogged down by complex Prioritize the risks that truly matter to your
software or elaborate frameworks at the organization. Concentrate resources on
outset. Implement basic tools and identifying, assessing, and mitigating the
processes immediately to build most significant threats and
momentum and demonstrate value. opportunities, avoiding analysis paralysis
Iterative improvement is key. on minor issues.

3 Enable Business Objectives 4 Embrace Informed Decision-

Position risk management as a strategic Making
enabler, helping the business achieve its Understand that achieving zero risk is
goals more securely and efficiently, rather often impossible and undesirable. The
than a bureaucratic hurdle. Frame risk goal is to make well-reasoned choices,
discussions around opportunities and understanding the potential upsides and
strategic advantage. downsides of each risk, and accepting
those that align with your strategic
objectives.

Prabh Nair