Risk Management Policy (ASF-QMS-003)

V3.0 — 6-category risk taxonomy, 5×5 Likelihood × Impact scoring matrix, 4-level colour-coded risk rating table with response timescales, 5-step assessment process, 10-field risk register specification, integration with audit and management review, 12 references

1. Purpose

This policy establishes ASF’s approach to risk management — the systematic identification, assessment, treatment, and monitoring of risks that could affect ASF’s ability to deliver a credible, impartial, and high-quality accreditation programme. Based on ISO 31000:2018, it is integrated with internal audit (ASF-QMS-001) and management review (ASF-QMS-002).

2. Risk Categories — 6 Types

Impartiality risk: undisclosed CoI; financial dependency; surveyor relationships. Standards quality risk: standards not updated in response to regulatory or clinical evidence changes. Operational risk: surveyor shortage; scheduling failures; key staff loss. Legal and compliance risk: GDPR breach; contractual breach; regulatory investigation. Reputational risk: adverse event at an accredited facility; media criticism; upheld complaint. Financial and sustainability risk: revenue shortfall; unpaid fees; unbudgeted costs.

3. Risk Scoring — 5×5 Matrix

Each risk is scored on Likelihood (1 = Rare → 5 = Almost certain) × Impact (1 = Negligible → 5 = Critical). Inherent risk score = Likelihood × Impact (range 1–25). Residual risk score = score after existing controls. Both are recorded in the risk register.

Risk levels: Critical (score 16–25): immediate escalation to ASF President; treatment plan within 5 working days. High (10–15): treatment plan within 15 working days; monthly monitoring. Medium (6–9): treatment plan within 30 working days; quarterly monitoring. Low (1–5): accepted or monitored; reviewed at annual audit. No Critical risk may be accepted without a compensating control that reduces the effective rating to High or below.

4. Risk Assessment — Five Steps

(1) Identification: from audit findings, management review outputs, complaints data, context changes, and staff/committee/surveyor input — any person may submit a risk at any time. (2) Analysis: QMS Coordinator assigns category, scores likelihood and impact, documents existing controls. (3) Evaluation: residual score calculated; Critical/High risks escalated to the President immediately. (4) Treatment: Avoid, Reduce, Transfer, or Accept — with a documented treatment plan for all Medium+ risks. (5) Monitoring: reviewed at annual management review; after each audit cycle; at extraordinary management review if triggered; and within 20 working days of any significant context change.

5. Risk Register

Maintained by QMS Coordinator; approved by ASF President; updated at least annually. Records for each risk: ID, category, description, current controls, inherent and residual scores, risk rating, treatment plan, owner, date last reviewed, and next review date. Presented as a mandatory input at the annual management review.

6. ISQua EEA Alignment

Supports ISQua EEA Principle 10 (Quality Management System — risk management) and Principle 4 (Independence — impartiality risk as a standing framework component). The ASF ISQua EEA Crosswalk (ASF-EV-004) maps these provisions to the applicable EEA criteria.

Document code: ASF-QMS-003  ·  Version: V3.0  ·  Effective: 2026-09-30  · 
All governance documents

Download the approved document

ASF-QMS-003 — Risk Management Policy · Version V3.0

Download PDF Full ASF Standards Package 2026