Risk Management Examples

Risk management examples show the four standard responses applied to a real exposure: avoid the activity, reduce its likelihood or impact, transfer it through insurance or contract, or accept it deliberately. A useful example names the organization, the date, the loss, the control that failed, and the decision that followed.

On 29 September 2025, Asahi Group Holdings suspended operations at six Japanese facilities. The Qilin ransomware group took credit, and Japan’s largest brewer, unable to run its ordering and shipping systems, fell back to phone calls and handwritten order forms.

Shipping for more product labels resumed around 15 October, and Asahi later confirmed that roughly 1.5 million customer records had been exposed alongside data on about 275,000 current and former employees and their families. The breach scope surfaced well after the operational outage closed, which is the usual sequence.

Risk Management Examples: Key Takeaways
Useful risk management examples name the organization, the date, the loss, and the response chosen, so the reader can copy the reasoning instead of admiring the anecdote.
Asahi suspended operations at six Japanese facilities on 29 September 2025 after a Qilin ransomware attack, ran orders by phone and handwritten forms, and later confirmed 1.5 million customer records exposed.
The UK Information Commissioner fined 23andMe GBP 2.31 million in June 2025 after credential stuffing reached 155,592 UK residents, because no multi-factor authentication guarded raw genetic data downloads.
Munich Re counted USD 224 billion of natural catastrophe losses in 2025 against USD 108 billion insured, and the January Los Angeles wildfires alone cost USD 53 billion with USD 40 billion covered.
Verizon’s 2025 breach report found third-party involvement in breaches doubled from 15 to 30 percent across more than 22,000 analyzed incidents, which moves vendor concentration onto the register.
Four responses cover every case: avoid the activity outright, cut likelihood or impact with controls, hand the loss to an insurer or counterparty, or accept it under signature with an indicator watching.

Strip away the brewery and that is a textbook register entry: a single IT dependency, a cause, a consequence with a date, and a response. The examples below all carry that structure, because an example you cannot convert into a register line is entertainment, not risk management.

What Risk Management Examples Actually Show

Every credible example resolves to one of four treatment choices set out in ISO 31000:2018 clause 6.5. Organizations avoid the activity, reduce the exposure with controls, transfer it to a third party, or accept it on purpose. Everything else is a variation on those four.

The choice depends on where the risk sits on likelihood and impact, and on what the organization can afford. Frequent, survivable losses justify controls; rare, ruinous ones justify insurance. Our guide to risk response options walks the decision rule in more detail.

Response	When it fits	Example from this article
Avoid	The exposure is unacceptable at any workable control cost	Lenders walking away from opaque off-balance-sheet structures
Reduce	Likelihood or impact can be cut by a funded control	Multi-factor authentication on sensitive data downloads
Transfer	Loss is rare but severe, and priced insurance exists	Catastrophe cover against wildfire and storm damage
Accept	Cost of treatment exceeds the exposure it removes	Minor vendor delays tracked by an indicator instead of a project

Five Real Risk Management Examples From the Past Year

Case studies age badly, so these five are all documented within the last eighteen months and each maps to a different category. Read them for the decision, skip the drama, and note what each organization could have known beforehand, because that is the part that transfers straight into your own register.

Operational risk: ransomware stops the production line

The Asahi shutdown is the cleanest operational example available right now. A cyber event became an operational one the moment order intake and dispatch stopped, which is why operational risk management and information security cannot sit in separate registers with separate owners.

Figure 1. An operational risk example with dates attached, which is what makes it usable.

The response was reduction plus manual continuity: isolate, restore, and keep shipping by fax while systems came back. That fallback existed because someone had thought about it, which is exactly what ISO 22301 asks organizations to prepare before the outage arrives.

Compliance risk: a regulator prices a missing control

In June 2025 the UK Information Commissioner fined 23andMe GBP 2.31 million after credential stuffing exposed data on 155,592 UK residents. The attack ran between April and September 2023, reusing credentials stolen in unrelated breaches. The regulator named the missing controls precisely: no multi-factor authentication, and no verification step before users downloaded raw genetic data.

The penalty started at GBP 4.59 million and halved after representations, which tells you the remediation argument matters. For compliance risk, the lesson is that regulators increasingly name the missing control itself, not the abstract failure to secure data.

Financial risk: the debt nobody could see

First Brands Group filed for Chapter 11 on 28 September 2025 with liabilities above USD 10 billion, and investigators then found billions more in off-balance-sheet financing tied to supplier and customer invoices. Supply chain finance debt alone topped USD 866 million across twelve creditors.

A USD 6.2 billion refinancing led by Jefferies had already paused that summer for a quality-of-earnings review. Anyone running a financial risk assessment on a counterparty should treat a paused refinancing as an indicator in its own right and ask in writing what the reviewers found, because here the answer arrived in bankruptcy court within months.

Hazard risk: the year insurance did not cover

The costliest example of the year was a hazard nobody could negotiate with. Munich Re put natural catastrophe losses for 2025 at USD 224 billion, of which USD 108 billion was insured. The January Los Angeles wildfires were the costliest single event at USD 53 billion total and roughly USD 40 billion insured.

Figure 2. Transfer moves loss, it does not erase it: the uninsured half stays with the business.

Weather-related events drove 92 percent of overall losses and 97 percent of insured losses last year. That gap between total and covered is the number to put in front of a board when discussing risk transfer as a strategy. Roughly half of the 2025 catastrophe loss stayed with the businesses and households that suffered it.

Strategic risk: concentration you inherited

Concentration is now measurable. Verizon’s 2025 breach report found third-party involvement in breaches doubled from 15 to 30 percent across more than 22,000 analyzed incidents. Concentration risk stopped being a procurement footnote the moment one supplier outage could stop three competitors at once. Each case here is also a small proof of why risk management is important when events arrive uninvited.

This one rarely gets its own register line, which is the problem. Map every critical activity to the vendors behind it, then treat any single point of failure as a strategic risk with a named owner, not a buried contract clause.

Figure 3. Five documented cases, four possible responses, and the verdict each one earned.

Matching the Response to What You Are Facing

Choosing between the four responses is where most programs wobble. The test is not which option sounds strongest, but which one changes the expected loss for a price the organization will actually pay. Our summary of risk management strategies sets out the same logic across a portfolio.

Four questions settle almost every case, and they work best asked in order. A negative answer to the first makes the remaining three academic, while a positive answer narrows the choice to two responses and usually ends the debate in the room:

• Could the organization survive this loss without external funding? If not, transfer or avoid.
• Does a control exist that cuts likelihood measurably, and is it funded this year?
• Is there a market for this risk, and does the premium beat the retained expected loss?
• If accepting, who signs, what indicator watches it, and what threshold reopens the decision?

Acceptance deserves the most scrutiny, because it is the response most often chosen by default. An accepted risk with no owner, no indicator, and no review date is not accepted; it is forgotten, and key risk indicators exist to stop that.

Worked Cases Across Six Risk Categories

Categories matter because they route a risk to the right owner and the right control library. The six below cover most registers we see, and each carries a concrete case instead of a definition. An empty category is the fastest tell that a register was assembled from headlines instead of from a walk through the organization’s own objectives and dependencies.

Figure 4. One example per category keeps a register honest about what it is missing.

Category	Worked example	Primary response	Owner
Financial	Counterparty carrying undisclosed off-balance-sheet debt	Avoid or reduce exposure limits	CFO
Compliance	Sensitive data downloads with no second authentication factor	Reduce with a funded control	Head of Compliance
Operational	Ransomware halting order intake and dispatch for weeks	Reduce, plus tested manual fallback	COO
Reputational	Breach notification reaching millions of customers	Reduce, with prepared communications	Head of Communications
Strategic	One vendor sitting behind three critical activities	Reduce concentration, or accept with indicators	Executive Committee
Hazard	Wildfire or flood loss exceeding the insurance program	Transfer, with retained loss stated	Risk Manager

Fraud belongs in this list too, and it is the category most often understated. The Association of Certified Fraud Examiners publishes its Report to the Nations on occupational fraud losses, and the median case in most editions runs long enough that detection controls carry the value that recovery cannot.

Turning a Case Study Into Your Own Register Entry

Reading examples changes nothing until one becomes a line in your own register. The conversion is mechanical, and takes about ten minutes per case once the format is familiar. Start from the elements of a risk register and fill them from the story.

Register field	What to extract from the example	Asahi worked through
Risk event	The thing that actually happened	Ransomware disables order and dispatch systems
Cause	The condition that allowed it	Single IT platform behind ordering, no segmented fallback
Consequence	Measured effect, in numbers	Weeks of suspended shipping; 1.5m records exposed
Existing control	What was already in place	Backups, incident response retainer, manual order route
Response	Which of the four, and funded how	Reduce: segmentation, tested fallback, monitoring
Indicator	What signals it forming again	Patch latency, privileged account count, restore test age

Score the entry on your own scale afterwards, never the one implied by the headline. A catastrophic loss at another firm may be a moderate one at yours, and risk appetite is what decides that, which is why copied scores travel badly between organizations.

Then close the loop, because conversion without follow-through is just tidier reading. Each converted example should produce one funded action with an owner and a date, and land in the next risk assessment cycle, never a slide deck that gets admired once and archived.

Lessons From Programs That Failed

Examples get misused in predictable ways, and we see the same four patterns across client registers. Each pattern turns a useful case study into decoration. None of them is a knowledge problem, because all four are governance failures wearing a research costume.

Pattern	How it shows up	The correction
Borrowed scores	Another firm’s rating copied without local calibration	Rescore against your own impact scale and appetite
Headline chasing	Register fills with famous incidents while local exposures go unlisted	Start from objectives, then find the matching case
No named owner	The example is discussed; nobody is accountable after	Every converted entry gets an owner and a date
Category blindness	Cyber and financial covered; hazard and strategic empty	Force one worked example per category each cycle

Governance catches most of this, provided the lines are real. The IIA Three Lines Model puts ownership in the business, oversight in the risk function, and assurance in internal audit, which prevents a register from becoming one team’s private document.

Regulators have their own version of the same expectation. US banking supervisors set out third-party risk expectations in interagency guidance, and the Federal Reserve’s SR 21-7 letter applies similar discipline, so the vendor example above has become a supervised topic and no longer merely good practice.

Risk Management Examples FAQs

What is a simple example of risk management?

A company identifies that one vendor runs its order system, scores the outage as likely and severe, then funds a tested manual fallback and a second supplier. That is identification, analysis, evaluation, and treatment in four sentences, which is all a working example needs to contain.

What are the four types of risk response with examples?

Avoid means exiting the activity, as lenders did with opaque financing structures. Reduce means funding a control, like multi-factor authentication on sensitive downloads. Transfer means buying insurance or writing contract terms against catastrophe loss, while accept means a documented decision carrying an owner, an indicator, and a review date.

What are examples of risk management in business?

Business examples run across categories: credit limits on a shaky counterparty, segregation of duties against fraud, catastrophe cover on a coastal facility, dual sourcing for a critical component, and prepared breach communications. Each pairs a named exposure with a funded response, never a policy statement about being careful.

How do you write a risk management example for a report?

State the event, the cause, the consequence with a number, the existing control, the chosen response, and the indicator that watches it. Six fields, one paragraph. Boards reject examples that skip the number or the owner, because neither the size nor the accountability can then be tested.

Is a risk example the same thing as a risk assessment?

An example is a single case, useful for calibration and training. A risk assessment is the systematic pass across all objectives, producing scored exposures and a ranked list. Examples feed assessments by showing what plausible looks like; they never replace the sweep itself.

Which risk management examples do auditors expect to see?

Auditors look for examples with evidence behind them: a dated decision, a funded action, a control test result, and a monitoring record. A register full of well-written entries with no supporting evidence fails the same way an empty register does, just more slowly and with better formatting.

The Practitioner’s Cheat Sheet

Two shifts are already changing which examples matter. Third-party incidents now account for 30 percent of breaches, so the interesting cases increasingly happen at suppliers, one step outside the organization holding the register. That share doubled in a single reporting year.

Disclosure timing is the second shift. Under the SEC’s cybersecurity disclosure rule, a materiality determination starts a countdown measured in business days, so the instructive examples now pair a rehearsed disclosure decision path with the technical recovery story instead of ending at containment.

Our position after years of building these registers, at a national pension fund and across advisory work: collect fewer examples and convert more of them. Ten cases properly converted into owned, funded, indicated entries beat a hundred admired in a workshop and forgotten by the next quarter, and the five-step process is what does the converting.

If your register reads like a list of headlines instead of a set of decisions, our advisory services run the conversion with your own exposures and your own scale. Get in touch and bring the three incidents that worried you most this year.