Risk Management: How Managers Can Build a More Resilient Organisation

25 July 2026

Risk Management: How Managers Can Build a More Resilient Organisation

The Foundation of Sustainable Performance

Effective risk management is one of the most consistently underinvested management disciplines in UK businesses. Yet the cost of getting it wrong is well-documented. UK businesses lose an estimated £22.9 billion annually to workplace injury and ill health alone, according to HSE statistics. Supply chain disruptions cost the average UK business 45% of annual profits over a ten-year period, according to McKinsey research. And the reputational damage from a preventable health and safety failure can outlast the financial consequences significantly.

Risk management isn’t about eliminating every possible threat — that’s neither achievable nor a useful goal. It’s about understanding what your organisation is genuinely exposed to, putting proportionate controls in place, and building a culture where people notice and report risks before they become incidents. Done well, it protects your people, stabilises your operations, and creates the kind of organisational resilience that allows a business to absorb disruption and continue growing.

This guide covers the five core disciplines of effective risk management: identifying risks systematically, understanding health risks as an operational concern, addressing specific compliance requirements like water safety, building organisational resilience, and maintaining continuous monitoring. Each one is a genuine management responsibility, not a specialist function to be delegated and forgotten.

Identifying Business Risks Systematically

The first step in protecting your business is developing a clear picture of what you’re actually exposed to. Risks cluster into four main categories — financial, operational, strategic, and compliance-related — and a comprehensive approach requires examining each one honestly rather than focusing on the most obvious or familiar threats.

The four risk categories worth mapping

Financial risks include cash flow problems, currency exposure for businesses operating internationally, rising input costs, and changes in credit availability. Operational risks relate to day-to-day processes — supply chain disruptions, equipment failure, key person dependency, and the vulnerabilities that come with any change in how or where work is done. Strategic risks concern the longer-term direction of the business: market shifts, competitive pressure, regulatory change, and the risks embedded in growth decisions. Compliance risks cover legal obligations across employment, health and safety, data protection, and sector-specific regulation — areas where failure creates not only financial exposure but potential criminal liability.

Mapping these categories in a risk register — a structured document that records each identified risk, its likelihood, its potential impact, and the controls in place — gives managers a tool for both prioritisation and communication. A risk that’s been identified, assessed, and actively managed is fundamentally different from one that’s known but not formally tracked. Good decision making and problem solving practice treats the risk register as a living management document rather than a compliance exercise completed once and filed.

Why Health Risks Are an Operational Concern

Financial and operational risks tend to dominate management attention. But threats to employee health carry consequences that are equally significant and often less visible until they’ve already accumulated into a serious problem. When team members are unwell, working in pain, or feeling genuinely unsafe, the effects show up across multiple performance dimensions simultaneously: productivity drops, absenteeism rises, morale deteriorates, and the best people start making decisions about whether to stay.

The hidden cost of ignored health risks

A healthy workforce is a productive one, and a safe environment is a prerequisite for genuine engagement and retention. The HSE’s 2024/25 statistics show that 1.9 million UK workers are suffering from work-related ill health — a figure that has increased from 1.7 million the previous year. Stress, depression, and anxiety account for 964,000 of those cases. Musculoskeletal disorders — the kinds of problems caused by poor ergonomics, manual handling, and inadequate workstation setup — account for 511,000 more.

Many of these conditions develop gradually from conditions that managers could observe and address earlier. Poor air quality, ergonomic hazards, inadequate temperature control, and insufficient facilities for hygiene and rest all contribute to chronic health problems that drain organisational energy quietly rather than triggering a visible incident. Treating them as minor background issues rather than genuine operational risks is a management choice with real performance consequences.

Water Safety: A Specific Compliance Obligation Many Managers Underestimate

One of the most frequently overlooked health risks in workplace management is water hygiene. Every business with a physical premises uses water — in restrooms, kitchens, cooling systems, showers, or industrial processes. Without proper management, water systems can become breeding grounds for harmful bacteria, with direct consequences for anyone on the premises.

The Legionella obligation

Legionella bacteria — the cause of Legionnaires’ disease — can proliferate in water systems where temperatures fall between 20°C and 45°C and water is allowed to stagnate. The UK Health Security Agency reported 472 cases of legionellosis in 2024. Outbreaks are entirely preventable with proper management, but the legal exposure when they occur is significant: fines of up to £20,000 per breach, potential unlimited fines and custodial sentences for serious failures, and reputational damage that tends to be disproportionate to the organisation’s size.

Under the Health and Safety at Work Act 1974 and the HSE’s Approved Code of Practice L8, employers have a legal duty to assess and control the risk of Legionella in water systems. For many businesses, this means commissioning a professional Legionella risk assessment to identify and document the specific risks in their water systems, and establishing a written scheme of control covering monitoring frequencies, responsible persons, and remedial procedures. Assessments should be reviewed at least every two years — and sooner if the building usage pattern changes significantly, as low-use outlets left stagnant following hybrid working arrangements have emerged as a particular risk factor in 2025 and 2026.

The broader water compliance picture

Legionella is the most visible water risk, but a complete water safety management approach also covers temperature monitoring across hot and cold water systems, management of infrequently used outlets, tank inspection records, and documented evidence of active management. The HSE expects organisations to be able to demonstrate an ongoing, documented programme of water safety management — not just a risk assessment on file. Managers should ensure a competent person is appointed with clear responsibility for the water safety programme, and that records are maintained in a format that would withstand regulatory scrutiny.

Building Organisational Resilience

Identifying risks is the foundation. Building an organisation that can withstand them is the ongoing work. Resilience isn’t a property an organisation either has or doesn’t — it’s a product of deliberate management choices about how people, processes, and information are structured.

Communication as a resilience mechanism

Everyone in the organisation should understand the most significant risks relevant to their role and know what to do when something goes wrong. This doesn’t mean sharing a comprehensive risk register with the whole team — it means making sure that the people closest to specific risks have clear, current information about what they’re watching for and how to escalate concerns. Psychological safety matters here: people who believe that raising a risk concern will be welcomed rather than ignored are the organisation’s most valuable early warning system. Managers who build that environment — where near-misses are reported, not hidden — catch problems at a stage when they’re still manageable. Good leadership and workplace wellbeing practice is what creates those conditions.

Training that builds genuine preparedness

Emergency drills, safety briefings, and regular education on protocols have a well-evidenced effect on incident rates — but only when they’re taken seriously rather than treated as compliance exercises. Training that people engage with because it’s relevant, specific, and regularly refreshed produces different outcomes than training people sit through because they’re required to. The same investment in content and delivery that produces good learning outcomes in any other context applies equally here.

Continuous Monitoring: Keeping Risk Management Alive

Risk management is a continuous cycle, not a one-time project. The business environment changes, new risks emerge, and existing controls can become less effective without anyone noticing. Without a structured monitoring approach, a risk management framework that was genuinely fit for purpose 18 months ago can quietly develop significant gaps.

Building a review rhythm that actually works

Quarterly or annual formal reviews of the risk register — involving department heads and team members who are closest to specific operational areas — keep the document current and ensure that control measures are being applied as designed rather than existing only on paper. The questions worth asking in each review are consistent: What has changed since the last review? Are there new risks that haven’t been captured? Are the controls we have in place still being applied consistently? What have near-misses in the past period told us about where the gaps are?

Key performance indicators that track incident rates, near-miss reporting, absenteeism, and compliance audit outcomes give managers the data to spot trends before they become problems. A rising near-miss rate in a particular area is valuable information — it usually indicates that an incident is being prevented by luck rather than design, and that an intervention is overdue. Treating that signal as a management priority rather than a statistical curiosity is what separates proactive risk management from reactive crisis management. The Knowledge Hub on managing performance and managing change covers the disciplines that make continuous review a genuine management habit.

Further Reading

• HSE: Managing Risks and Risk Assessment at Work — The Health and Safety Executive’s authoritative guidance on risk assessment methodology, legal obligations, and practical implementation for UK employers. The definitive starting point for any manager building a risk management framework. Read the guidance
• HSE: Legionella and Legionnaires’ Disease — Approved Code of Practice L8 — The HSE’s ACoP L8 guidance covering legal duties, risk assessment requirements, and control measures for Legionella in workplace water systems. Essential reference for any manager responsible for a premises with water systems. Read the guidance
• CIPD: Health and Wellbeing at Work 2025 — Annual UK research on workplace health, covering absence rates, presenteeism, and the management practices most strongly associated with healthy, high-performing teams. Read the report

Header Photo by Memento Media on Unsplash

Disclaimer

The content on this site is provided for general information and educational purposes only. It reflects the author’s views and experience and is not intended as professional health and safety, legal, or compliance advice. Risk management requirements vary by sector, organisation size, and jurisdiction. Readers should refer to current HSE guidance and seek appropriate professional advice before making changes to risk management practices. The Happy Manager and Apex Leadership Ltd accept no liability for actions taken in reliance on the content of this article.

References

1. Health and Safety Executive (2025). Health and Safety at Work: Summary Statistics for Great Britain 2025. https://www.hse.gov.uk/statistics/assets/docs/hssh2425.pdf
2. UK Health Security Agency (2025). Legionellosis in England and Wales: 2024 Annual Report. Referenced in: The Testing Lab (2026). https://thetestinglab.eu/legionella-logbook-requirements-the-essential-uk-compliance-checklist-2026/
3. Aqua Compliance (2026). The Ultimate Legionella Compliance Checklist for 2026. https://aquacompliance.co.uk/blog/the-ultimate-legionella-compliance-checklist-for-2026/
4. HSE. Approved Code of Practice L8: Legionnaires’ Disease — The Control of Legionella Bacteria in Water Systems. https://www.hse.gov.uk/legionnaires/
5. DAC Beachcroft (2025). HSE Annual Statistics and Report 2025: Trends and Strategic Priorities for 2026. https://www.dacbeachcroft.com/en/What-we-think/HSE-Annual-Statistics-and-Report-2025-Trends-and-Strategic-Priorities-for-2026

Leadership Resources

For more leadership resources look at our great-value guides. These include some excellent tools to help your personal development plan. The best-value approach is to buy our Leadership bundle, available from the store.

We’ve bundled together these five e-guides at half the normal price! Read the guides in this order, and use the tools in each, and you’ll be well on your way to achieving your personal development plan. (6 guides, 167 pages, 27 tools and 22 insights, for half price!)

• Leadership Essentials
• Defining Leadership
• Leading Insights
• Leading with Style and Focus
• Transformational Change
• Making Change Personal

>> Return to the Leadership Knowledge Hub