Risk-based approach
Definition
Risk-based approach
A risk-based approach puts control effort where the exposure is. You rate each risk, then match the depth of checks to that score. High risk work gets tight control and close review, while low risk work gets a light touch.
Three nearby ideas get muddled. A risk-based approach allocates effort, while a risk register template records what the risks actually are. A risk transfer strategy moves exposure onto another party.
This page covers the allocation decision — the rule that decides how much control a given exposure earns, and nothing wider than that.
It sits inside enterprise risk management rather than replacing it. That programme runs the company wide loop of finding, rating and owning exposures. The approach here answers one question inside that loop: how much control does this exposure deserve?
Key takeaways
- Effort follows exposure, so the highest scoring risks earn the deepest controls and the shortest review cycles.
- A scoring scale everyone accepts has to exist first, or tiering is only opinion with numbers attached.
- Tiering saves money when the low tier genuinely does less, not when it does the same work on a shorter form.
- Re-rate on a fixed cadence, because last year’s quiet supplier can become this year’s single point of failure.
How it works
A risk-based approach runs in four moves. List what could go wrong, score each item for likelihood and impact, sort the scores into tiers, then publish the control set each tier earns. The arithmetic is easy — the tier boundaries carry the argument.
Set the thresholds before you score anything. Published in advance, they survive the awkward cases. Written afterwards, they bend toward whichever business unit complains loudest.
Two numbers decide everything downstream. Likelihood asks how often this happens and impact asks what it costs when it does, and the product of the two is the only figure the tier rule reads.
| Tier | Control depth | Review rhythm | Evidence expected |
|---|---|---|---|
| High | Full assessment, named owner, tested controls | Quarterly | Samples pulled and checked |
| Medium | Standard assessment on a fixed template | Twice a year | Documents reviewed |
| Low | Self declaration | Annually | Exceptions reported only |
A tier only means something if it changes behaviour. If the low tier still fills in the same forty question form as the high tier, you have relabelled the work rather than reduced it.
Financial regulation writes the method down plainly. United States anti-money laundering rules for banks call for risk-based procedures for ongoing customer due diligence, including a customer risk profile for each relationship.
Technology control follows the same logic. The National Institute of Standards and Technology (NIST) published Revision 2 of its Risk Management Framework in 2018, running from security categorization through control selection to continuous monitoring.
Scoring is not the same as knowing. A tier states what you believe today, so record the evidence behind each score — otherwise next year’s reviewer cannot tell a judgement from a guess.
Depth of checking is where tiering becomes visible. A high tier supplier gets the full due diligence checklist and a site visit. A low tier one gets a short questionnaire and a credit check.
The scoring has to live somewhere. Most companies hang it off a governance risk compliance structure, so one scale and one committee cover financial, operational and regulatory exposure together.
Controls then follow the score. Compliance program design sets the policies and training each tier earns, and internal audit strategy decides how often somebody independent goes and looks.
Regulators want the logic, not only the result. A regulatory reporting framework that records why a customer or supplier landed in a given tier is what turns a defensible method into evidence.
Examples
The method appears wherever supervision costs money and attention is finite. Banks tier customers, buyers tier suppliers, and border agencies tier shipments. In every case the cheap check is the default and the expensive check has to be earned.
Banking and payments. A salaried local customer clears standard identity checks. A cash intensive business in a higher risk sector gets enhanced review, a documented risk profile and a shorter refresh cycle.
Outsourced operations. A buyer running 300 suppliers cannot assess them all to the same depth. The twenty that touch customer data or payroll get an annual on site review; the rest file an attestation and an exception report.
Customs and trade. Border agencies clear most consignments on documents alone and physically inspect a small, targeted share chosen on trader history and route. Inspection capacity is fixed, so targeting is the only variable left.
Clinical and food safety. Inspectors visit high hazard sites more often than low hazard ones and publish the rating that decides the interval — which is tiering made public, and it changes behaviour on its own.
Related terms
A risk-based approach borders several terms that each carry one part of the job: recording the exposure, housing the scale, testing the result, or handing the work to somebody else. These five come up most often.
- Due diligence checklist: the fixed set of checks a high tier counterparty has to clear.
- Governance risk compliance: the combined structure that houses the scoring scale and the committee behind it.
- Internal audit strategy: the independent testing plan that proves the tiering is actually applied.
- Risk outsourcing: handing a risk process, rather than the risk itself, to a specialist provider.
- Organizational readiness assessment: the check on whether a team can run the controls its tier demands.
FAQ
What is a risk-based approach in simple terms?
You spend more time, money and scrutiny on the things most likely to hurt you, and less on the things that are not. Effort is proportional to exposure rather than spread evenly.
How is it different from a risk register?
A register records the risks, their owners and their scores. A risk-based approach is the rule that decides what each of those scores buys in control.
What do you need before you can tier anything?
One scoring scale, an agreed threshold for each tier, and a named owner for every risk. Without published thresholds, tiering turns into an argument every time.
Does a risk-based approach reduce compliance work?
It redistributes it. Total effort can stay flat while high risk cases get far more attention and low risk cases get much less.
Can you apply it to outsourced work?
Yes, by tiering providers on what their failure would cost you and matching oversight to that tier.
Compare vetted providers across the Outsource Accelerator network before deciding which risks are safe to place outside the business.
Independent
