Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    Risk Management

    Also known as: Managing risk, Risk management process

    Definition

    The coordinated activities that direct and control an organisation with regard to risk, of which risk assessment is one part.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/risk-management

    Scope: It is wider than assessing risk: NIST's glossary also lists establishing context, responding to risk and monitoring. The same words carry other definitions in other fields, such as information security, and the legal duties differ by jurisdiction.

    Example for your evaluation: Show the assessment, the response chosen, who accepted any remaining risk, and the monitoring entry that reopened it.

    Sources checked: . Examples are editorial illustrations.

    What NIST, OSHA and EU-OSHA say about managing risk

    The wording most often given for risk management is coordinated activities to direct and control an organisation with regard to risk. NIST's glossary gives that wording and attributes it to ISO Guide 73. ISO's pages could not be opened on 16 October 2026, because they were blocked to automated requests, so the text of ISO 31000 is not reported here. The same glossary shows that definitions vary by field. One entry calls risk management the process of identifying, assessing and responding to risk. Another, for information security, describes a programme that covers establishing context, assessing risk, responding to risk and monitoring it over time.

    NIST's glossary also gives the ISO Guide 73 wording for risk assessment: the overall process of risk identification, risk analysis and risk evaluation. An entry drawn from NIST SP 800-39 says risk assessment is part of risk management. The distinction is therefore one of scope: assessment finds and judges the risk, while management adds the decision on what to do, the action, the monitoring afterwards and the communication around it.

    In workplace safety the same layering appears. OSHA's page on safety and health practices lists seven core elements: management leadership, worker participation, hazard identification and assessment, hazard prevention and control, education and training, evaluation and improvement, and coordination with host employers, contractors and staffing agencies. Assessment is the third. OSHA presents them as guidance for small and medium-sized businesses and does not address legal obligations on that page. EU-OSHA says Directive 89/391/EEC, dated 12 June 1989, obliges employers to take appropriate preventive measures. It lists risk assessment as a key element, with hazard identification, worker participation, adequate measures, documentation and periodic reassessment, and says the duty implicitly requires safety and health management to be built into general management processes. The text of the directive's articles could not be opened, so no article numbers are given. This page is general information, not legal advice.

    Sources opened :

    What a risk management record holds in software

    • The scope and context: which activities, sites or objectives are covered, the criteria for judging risk, and who approved them.
    • Each risk, with its source, the possible consequences, an owner and the assessment behind it.
    • The response chosen for each risk, with an owner, a date and the expected effect.
    • The risk that remains after the response, and who accepted it.
    • Monitoring and review entries with dates, what changed and what prompted the review.
    • A record of who was told and consulted, including workers and contractors.
    • Links from each risk to the detailed assessments, incidents, audit findings and actions that bear on it.

    Risk management, risk assessment, HIRA and a risk register

    Risk management is the wider set of coordinated activities, and a risk assessment is one part of it. HIRA is a name for the hazard form of assessment, and a risk register is a record that either can produce. A tool with an assessment form does not show by itself that risk is managed, because the decisions, monitoring and communication happen around the form. The same words are defined differently in other fields, such as information security.

    A hypothetical example: one risk followed through the process

    This case is invented and describes no real company. A small packaging firm records its scope, which covers its production lines and its main suppliers, and the criteria it uses to judge risk, with the owner who approved them. It enters a risk that workers are exposed to solvent vapour at a cleaning station. The assessment behind it names who is exposed, how, and the controls present, and the entry records the owner and the date.

    The response chosen is a lower-emission cleaning material plus extraction, each with a date and an owner, and the remaining risk is recorded with the manager who accepted it. Six months later a monitoring entry shows that the new material has a single supplier with long lead times. The owner reopens the risk, links the supplier problem as a second entry, and tells workers and purchasing what changed. The register keeps both entries, the criteria version used for each, and the review date.

    Common misunderstandings about risk management

    • Risk management is not another name for risk assessment. Assessment is one part, and NIST's glossary describes it as part of risk management.
    • It has no single definition across fields. NIST's glossary gives several, and information security uses its own.
    • A risk register is not risk management. It is a record, and the activities of response, monitoring and communication sit around it.
    • It is not a separate activity beside normal management. EU-OSHA says safety and health management is implicitly required to be built into general management processes.
    • A written framework is not the same as practice. OSHA's list includes evaluation and improvement, a step that follows carrying the work out.
    • The legal duty is not the same everywhere. OSHA's page does not address legal obligations, and EU-OSHA describes an EU directive.

    How risk management relates to other glossary terms

    Risk management is the wide frame, so the nearest terms are the standard that describes it and the narrower tools that work inside it.

    • ISO 31000: ISO's risk management guidelines, described on their own page.
    • ISO 45001: the management system standard for occupational health and safety, narrower than general risk management.
    • Hierarchy of controls: the order in which measures are considered when a workplace risk calls for a response.
    • Bow-tie analysis: a method for showing the barriers between a hazardous event and its causes and consequences.

    Records and evidence that usually exist for risk management

    • The procedure that sets scope, criteria and who may accept risk.
    • The risk register or set of assessments, with owners and dates.
    • Records of the response chosen, with actions, owners, due dates and completion.
    • Monitoring and review records that show what prompted each review.
    • Records of consultation and communication with workers and others affected.
    • Management review minutes showing that risks were discussed and decisions recorded.

    What a software tool needs to capture for risk management

    • Risk records tied to an activity or objective and an owner, not only to a hazard.
    • Configurable criteria and scales, with the version stored on every result.
    • Separate fields for the assessment result, the response chosen and the remaining risk.
    • Monitoring and review on a schedule and on events, with the history kept.
    • Links from each risk to detailed assessments, incidents, audit findings and actions.
    • Reports that show which steps are complete, not only a heat map.

    Catalog profiles documenting risk assessment workflows

    Listed profiles meet the risk assessment rule. That shows documented assessment records, not support for the wider activities of risk management, so ask which parts of the process a product records.

    Same rule for every product: tagged “Risk Assessment” or “Risk Management”, with a sourced risk assessment or risk register capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 37 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    Is risk management the same as risk assessment?

    No. NIST's glossary gives the ISO Guide 73 wording for risk assessment as the overall process of risk identification, risk analysis and risk evaluation, and for risk management as coordinated activities to direct and control an organisation with regard to risk.

    Is a risk management system required by law?

    It depends on the jurisdiction. EU-OSHA says the Framework Directive obliges employers to take preventive measures with risk assessment as a key element. OSHA's page on safety and health practices presents its seven elements as guidance and does not address legal obligations. Check the rules that apply.

    Does risk management mean the same in information security?

    The words are shared but the definitions are not. NIST's glossary gives several, among them the process of identifying, assessing and responding to risk.

    More qhse terms

    Related guides