In enterprise risk management (ERM), the concept of closing a risk refers to formally removing it from active monitoring and reporting processes. This decision, however, should never be taken lightly. The closure of a risk must be based on evidence, critical evaluation, and alignment with organisational risk appetite and strategic objectives.
In thus post we discuss when and If It May Be Appropriate to Close a Risk in Enterprise Risk Management
________________________________________________________________________________________________
________________________________________________________________________________________________
When Is It Appropriate to Close a Risk?
There are a number of reasons for closing a risk.
-
The Risk Has Been Fully Mitigated or Eliminated A risk can be closed if the organisation has implemented robust controls that demonstrably and sustainably reduce the likelihood and/or impact of the risk to an acceptable level. For example, if a business risk relating to outdated software is addressed through a system-wide upgrade and strong patching policies, the residual risk may be negligible.
-
The Risk Is No Longer Relevant Risks may become obsolete due to structural, regulatory, technological, or market changes. If a company discontinues a business line, the associated operational or compliance risks may no longer apply. Similarly, geopolitical risks affecting a region may no longer be relevant if the organisation has exited that market.
-
The Risk Has Materialised and Been Addressed Sometimes, a risk event may occur, be managed effectively, and leave no residual exposure. In such cases, the risk might be closed with a lessons-learned review and appropriate documentation. However, if the underlying conditions persist, the risk should evolve rather than close.
-
The Risk Is Accepted and Monitored Through Other Means Where a risk is consciously accepted because it falls within risk appetite—and is monitored through another governance process (e.g. project assurance, compliance reviews)—it may be closed from the main ERM register to avoid duplication.
-
The Risk Has Been Avoided. This means that the activity that presented the risk has been stopped in order to prevent the risk. This is appropriate when the risk seriously exceeds your appetite or tolerance for risk.
________________________________________________________________________________________________
Sign Up Here:
________________________________________________________________________________________________
When Should a Risk Not Be Closed?
Risk closure is not always the appropriate outcome for a risk. In many instances it can be better to keep a risk open. For example:
-
Residual Risk Remains Unclear or Unacceptable If it’s uncertain whether existing controls are effective, or if there’s a possibility of reoccurrence, the risk should remain active. Closing it prematurely may breed complacency.
-
The Environment Is Still Volatile or Unstable In rapidly changing sectors or regulatory landscapes, dormant risks can reactivate. A closed cyber risk today may re-emerge tomorrow if threat actors evolve or defences degrade.
-
There Is Insufficient Evidence of Closure Closure must be evidence-led. Documentation should demonstrate that mitigation strategies were implemented, monitored, and validated. Subjective assurances or verbal commitments are not sufficient.
Governance Considerations Before Closure
So, sometimes it is appropriate to close a risk, and sometimes to keep if open. How do you decide if closing risks is the right approach?
-
Risk Closure Criteria: These should be documented in the risk management framework or policy, outlining the thresholds for closure. They can be based on some of the reasons to close a risk set out above.
-
Audit and Review: All closure of risks should be auditable. A risk committee or internal audit should be able to trace the rationale, approvals, and supporting evidence for closed risks.
-
Lessons Learned: Closure is an opportunity to reflect on how the risk was managed and whether the organisation is better prepared in future.
-
Post Closure: when a risk is closed it must be recorded somewhere. This is relevant to prevent risk duplication or to allow for a risk to be reopened if it emerges again
Closing a Risk Is Not the Same as Ignoring It
Ultimately, closing risks should reflect maturity—not neglect. It is appropriate when the risk no longer poses a material threat and continuing to track it would divert resources from more pressing exposures. But in complex, interdependent organisations, every closure must be a considered act of governance, not a procedural convenience.
Done properly, closing risks enables focus. Done poorly, it breeds vulnerability.
________________________________________________________________________________________________
Gain the practical skills you need to identify and manage risk with this five-star rated training course.
Available in person, online or in-house the focus on practical skills and unique post-course support you get by learning with us will ensure you and your organisation can tackle this key governance activity with confidence.
________________________________________________________________________________________________