The OTR GroupAnyone who works around government projects will hear the Orange Book mentioned. It is the UK government''s guidance on managing risk, and its ideas are useful well beyond Whitehall. These five questions cover the essentials, using the wording in the GOV.UK publication.
1. What is the Orange Book?
The Orange Book is titled Management of Risk: Principles and Concepts. GOV.UK describes it as guidance that establishes the concept of risk management and gives a basic introduction to its concepts and to the development and implementation of risk management processes in government organisations. It is published by the Government Finance Function and HM Treasury.
2. How old is it, and has it changed?
It was first published on 29 May 2013. The GOV.UK update history records a revision in February 2020 and a new edition, with a new annex on portfolio risk management, on 4 May 2023. The current document says it builds on the 2020 version with the addition of a new section, Part II, the Risk Control Framework. Because the collection page is updated from time to time, check GOV.UK for the current version before you quote it.
3. Who does it apply to?
The guidance says it is applicable to all government departments and arm''s length public bodies, including executive agencies, non-departmental public bodies and non-ministerial departments, with responsibility derived from central government for public funds. It adds that it may be useful to all parts of the UK public sector, as the same principles generally apply with adjustments for context. Its primary audience includes accounting officers, board members, audit and risk assurance committee members, risk practitioners and senior responsible owners of programmes and projects.
4. What are the principles?
Part I sets out five main principles, grouped in sections A to E:
- A, Governance and leadership: risk management shall be an essential part of governance and leadership.
- B, Integration: risk management shall be an integral part of all organisational activities, to support decision-making in achieving objectives.
- C, Collaboration and best information: risk management shall be collaborative and informed by the best available information and expertise.
- D, Risk management processes: processes shall be structured to include risk identification and assessment, selection and implementation of risk treatment options, monitoring and reporting.
- E, Continual improvement: risk management shall be continually improved through learning and experience.
Each section also has supporting principles. The guidance explains that the main principles are mandatory requirements, while the supporting principles are advisory. Organisations follow a comply-or-explain approach: they either disclose compliance or explain their reasons for departure in their governance statement.
5. What does it say about risk appetite?
Risk appetite appears in several places. One principle says the board should determine and continuously assess the principal risks the organisation is willing to take to achieve its objectives, which the guidance calls its risk appetite. Another says that when risks are evaluated, the results of the analysis should be compared with the nature and extent of the risks the organisation is willing to take. A further principle says information should help the board assess whether decisions are being made within its risk appetite.
Using it on your own projects
You do not need to work in government to borrow the thinking. A simple test is to ask of any project: who owns the risks, how do they feed into decisions, and are we learning from what happens? Those questions map neatly onto principles A, B and E.
General information only. For requirements that apply to your organisation, read the current publication on GOV.UK.