Risk and risk management can sometimes be misunderstood. There is a view that the prudent approach is to avoid risk by simply maintaining the status quo. Linked to this is the idea that audit is a barrier to risk taking and innovation. Also, spending time developing risk management strategies can sometimes be perceived as mere pointless bureaucracy. Failure to take opportunities can be a huge risk in itself. By not looking at new ways of doing things organizations can miss out on real opportunities to manage better their business, improve service delivery and achieve value for money. Following the Turnbull report organizations are busy working on risk management frameworks and internal control statements to embed risk management in their management processes. This publication draws on experience from a variety of experts from the public and private sectors. It sets out a framework for taking informed decisions about risk at a project, programme and strategic level to ensure that key risks are identified and assessed and that action is taken to address them.