A risk posture says how much of each risk a business will accept. For harm to people, most boards should say none knowingly accepted. The heat map below shows how controls should move risks. The placements are an illustration: your board should rate its own.
Risk heat map: an illustration
Almost certain
Medium
High
Extreme
Extreme
Extreme
Likely
Medium
High
High4
Extreme
Extreme1
Possible
Low
Medium
High6
High25
Extreme3
Unlikely
Low
Medium
Medium
High
High
Rare
Low
Low
Low
Medium
Medium
Minor
Moderate
Serious
Major
Severe
- 1Undeclared allergen: Extreme
- 2Pathogen growth from temperature failure: High
- 3Listeria in ready-to-eat food: Extreme
- 4Ill or untrained staff: High
- 5Unsafe food reaches customers: High
- 6Assurance gives false comfort: High
Rows show likelihood and columns show consequence. Controls mostly lower the likelihood, so a severe consequence stays severe. Placements are illustrative, not data.
| Risk | Consequence | Key control | Evidence the board can ask for | Owner |
|---|---|---|---|---|
| growth from temperature failure | Illness, | Temperature control and | and how fast they closed | Accountable manager |
| Undeclared | Severe , possibly death | and special-request procedure | currency, incidents | Programme owner |
| in food | Severe illness in vulnerable people | Hygiene and environmental | Swab results and trend | Programme owner |
| Ill or untrained staff | Outbreak, especially | Illness policy, training | Training coverage, illness reports | Accountable manager |
| Unsafe food reaches customers | , regulator action, brand damage | and plan | Date and result of last | Accountable manager |
| Assurance gives false comfort | Failures found late | Independent audit | Scope, findings and repeat findings | Board |
| Area | A possible appetite statement |
|---|---|
| Harm to customers | No knowing acceptance. Food that fails a doesn't reach a customer. |
| Legal compliance | No knowing breach. Any notice from a regulator goes to the board. |
| No claims the business can't support. | |
| Reputation | Disclose promptly and honestly, even when it's uncomfortable. |
| Cost | Efficiency never removes a critical control. Changes go through a risk check. |