Risk and risk management can sometimes be misunderstood. There is a view that the prudent approach is to avoid risk by simply maintaining the status quo. Linked to this is the idea that audit is a barrier to risk taking and innovation. Also spending time developing risk management strategies can sometimes be perceived as mere pointless bureaucracy.

Failure to take opportunities can be a huge risk in itself. By not looking at new ways of doing things organisations can miss out on real opportunities to manage better their business, improve service delivery and achieve value for money.

Following the Turnbull report organisations are now busy working on risk management frameworks and internal control statements to embed risk management in their management processes. This publication draws on experience from a variety of experts from the public and private sectors.

A number of small improvements have been made to this 2004 Edition primarily to provide more clarity on some key principles.