Services
Risk & Controls Management
Structured risk identification, proportionate controls, and the governance frameworks that keep risk management a living part of your business - not a box-ticking exercise.
Risk management that actually changes how you operate
Many organisations have a risk register. Far fewer have a risk management programme. There's a meaningful difference: a risk register created to satisfy an auditor is a document; a working risk management programme is a process that informs decisions, triggers action, and reduces real-world exposure.
Elmar builds and embeds operational risk frameworks that actually get used. We start from your specific threat landscape - not a generic template - and work with you to identify, score, and treat risks in a way that's proportionate to your business size and sector.
Peter Berry has spent over 20 years managing risk in complex, regulated environments - including energy sector organisations where risk failures have significant regulatory and financial consequences. That experience shapes how we think about risk management for SMEs: seriously, but without over-engineering.
What We Cover
Focus areas
End-to-end risk management - from identifying what threatens your business to building the structures that keep it under control.
Threat Identification & Mapping
Structured threat workshops and risk identification exercises that surface what your business actually faces - not a generic checklist. We map threats to your specific operating environment, sector, and data assets.
Risk Registers & Scoring
Building and maintaining a living risk register with consistent likelihood/impact scoring, risk ownership, and treatment decisions - structured to satisfy board-level governance expectations and audit requirements.
Mitigating Controls Design
Translating identified risks into practical, proportionate controls - technical, procedural, and organisational. We help you design controls that actually reduce risk exposure rather than generating paperwork.
Risk Appetite & Tolerance Frameworks
Defining and documenting your organisation's risk appetite - the level of risk your board is willing to accept in pursuit of its objectives. Includes tolerance thresholds, escalation triggers, and board reporting templates.
Operational Governance
Policies, procedures, and committee structures that embed risk management into day-to-day operations - so that risk isn't just a quarterly board agenda item but part of how your organisation actually makes decisions.
Business Continuity Planning
Business impact analysis, recovery time objectives, continuity plan documentation, and tabletop exercises - so your business knows exactly what to do when disruption hits, and your continuity plan is tested rather than theoretical.
How to Work With Us
Engagement options
Whether you need to build a risk framework from scratch or maintain and evolve one that already exists, we have a structure that works.
Retainer
Outsourced Risk Manager
Senior risk oversight embedded into your organisation.
We act as your embedded risk management function - maintaining your risk register, chairing risk reviews, monitoring your control environment, and keeping your board informed with clear, concise reporting. All the oversight, none of the overhead.
- Ongoing risk register maintenance
- Regular risk review sessions
- Control effectiveness monitoring
- Board and management reporting
- Incident and near-miss review
- Regulatory change impact assessment
Fixed-Fee Project
Risk Identification & Controls Setup
A solid risk framework built from scratch, agreed upfront.
For organisations starting from zero - or those whose existing risk register is outdated and ineffective. We scope, build, and hand over a fully operational risk framework: register, controls, appetite statement, and governance structure.
- Facilitated threat identification workshop
- Risk register creation & scoring
- Mitigating controls specification
- Risk appetite statement
- Governance structure design
- Handover documentation & training
Ready to start?
Talk to us about your risk management needs
Whether you need a complete risk framework built from scratch or an experienced hand to maintain what you have, get in touch for a no-obligation conversation.
Get in Touch