Identifying and Auditing risk Risk assessment processes Identifying mitigating actions Maintaining risk registers and regular monitoring Involving staff in risk management Creating a risk management culture