Risk Management Services
Defence Risk Management That Holds Under Scrutiny
Risk management in the defence sector is not a compliance exercise — it is a contractual obligation, a procurement requirement, and a board-level responsibility. WHG builds risk management programmes that satisfy MOD expectations, align to JSP 892 and ISO 31000, and create genuine organisational resilience.
Risk Management in the Defence Context
The MOD's risk management framework — JSP 892 — sets clear expectations for how defence organisations and their supply chains identify, assess, and manage risk. For suppliers and contractors, alignment with JSP 892 is increasingly a condition of contract award and ongoing supply chain qualification.
ISO 31000 provides the international standard for risk management principles and guidelines. In the defence sector, ISO 31000 is the civilian framework that underpins JSP 892 alignment — organisations that implement ISO 31000 correctly are well-positioned to satisfy MOD risk governance requirements.
WHG designs and implements risk management programmes that satisfy both frameworks — building the risk registers, governance structures, and review cycles that demonstrate genuine risk management capability to MOD auditors, prime contractors, and certification bodies.
Frameworks We Align To
Defence Risk Categories
WHG addresses the full spectrum of risk categories relevant to defence organisations and their supply chains — not just quality and compliance, but the complete risk landscape of operating in the defence sector.
Contractual & Compliance Risk
Failure to meet Def Stan, JSP, or ISO requirements — resulting in contract termination, audit findings, or loss of certification.
Information Security Risk
Unauthorised access to classified or sensitive defence data — including cyber threats, insider risk, and supply chain data breaches.
Safety-Critical Risk
Failure of safety management systems in environments where personnel or public safety is at risk — including JSP 375 obligations.
Supply Chain Risk
Supplier failure, single-source dependency, sub-tier non-compliance, or export control violations within the supply chain.
Export Control & ITAR Risk
Inadvertent breach of UK Strategic Export Controls or US ITAR — including technology transfer, deemed export, and re-export violations.
Business Continuity Risk
Disruption to critical functions supporting defence contracts — including key person dependency, facility loss, and IT system failure.
Reputational & Stakeholder Risk
Loss of MOD confidence, prime contractor qualification, or public trust — arising from compliance failure, audit findings, or incident response.
Configuration & Technical Risk
Unauthorised change to safety-critical or contractually-specified configurations — including Def Stan 05-57 configuration management obligations.
Risk Identification and Assessment
Effective risk identification requires a structured methodology that captures risks across all dimensions of the organisation — strategic, operational, financial, compliance, information security, health and safety, and supply chain. In defence, this must also account for the specific risk landscape of working with classified information, export-controlled technology, and safety-critical systems.
WHG implements risk identification workshops, structured risk registers, and consequence/likelihood assessment frameworks calibrated to the defence operating environment. We ensure your risk assessment methodology is documented, repeatable, and defensible under audit.
Mitigation Strategies Aligned to Defence Standards
Risk mitigation in defence must be proportionate, documented, and evidenced. The MOD expects to see not just that risks have been identified, but that controls are in place, that control effectiveness is monitored, and that residual risk is formally accepted at the appropriate level of the organisation.
WHG designs mitigation frameworks that align with Def Stan requirements, JSP 892 principles, and ISO 31000 guidelines — building the control registers, monitoring mechanisms, and risk acceptance records that satisfy defence procurement and audit requirements.
The WHG Mitigation Approach
Four structured steps from risk appetite definition to ongoing control monitoring — building a mitigation framework that satisfies defence procurement requirements and withstands audit scrutiny.
01
Risk Appetite Definition
We work with your board to define a documented risk appetite statement — establishing the level of risk the organisation is willing to accept in pursuit of its objectives, and the thresholds that trigger escalation.
02
Control Framework Design
We design a control framework that maps each identified risk to specific preventive and detective controls — aligned to the applicable Def Stan, JSP, or ISO requirement.
03
Residual Risk Acceptance
We implement a formal residual risk acceptance process — ensuring that risks remaining after controls are applied are formally accepted at the appropriate level of the organisation, with documented rationale.
04
Control Monitoring
We build monitoring mechanisms that provide ongoing assurance that controls are operating effectively — including KPIs, periodic testing, and integration with the internal audit programme.
Board-Level Risk Governance
JSP 892 and ISO 31000 both require that risk management is driven from the top of the organisation. The board must set the risk appetite, receive regular risk reporting, and demonstrate active oversight — not delegate risk management entirely to operational teams.
WHG works with boards and senior leadership teams to establish the governance structures, reporting mechanisms, and review cycles that demonstrate genuine board-level risk ownership to MOD auditors and prime contractors.
Risk Appetite Statement
Board-approved statement defining the organisation's tolerance for each risk category — the foundation of a credible risk governance framework.
Risk Dashboard
A concise board-level risk dashboard showing the top risks, their current status, trend direction, and control effectiveness — updated at each board meeting.
Escalation Protocol
A documented escalation protocol defining which risks require board notification, the timescales for escalation, and the board's expected response.
Risk Review Cadence
A structured review cycle — typically quarterly at operational level and at each board meeting — ensuring the risk register remains current and relevant.
Four-Stage Supplier Risk Programme
Supplier Criticality Mapping
We map your supply chain by criticality — identifying single-source dependencies, safety-critical suppliers, and those with access to classified information or export-controlled technology.
Risk-Based Qualification
We design a tiered qualification process that applies proportionate due diligence based on supplier criticality — from desktop assessment for low-risk suppliers to full on-site audit for critical tier-one suppliers.
Ongoing Monitoring Framework
We implement an ongoing monitoring framework — periodic performance reviews, financial health checks, compliance status monitoring, and trigger-based reassessment for emerging risks.
Escalation and Contingency
We build escalation protocols and contingency plans for supplier failure scenarios — ensuring your organisation can respond rapidly to supply chain disruption without compromising contract delivery.
Third-Party and Supplier Risk Management
Supply chain risk is one of the most significant and least well-managed risk categories in the defence sector. Prime contractors are increasingly required to demonstrate that their tier-two and tier-three suppliers are managed as part of a coherent supply chain risk programme — not just assessed at qualification and forgotten.
WHG designs supplier risk management frameworks that cover initial qualification, ongoing monitoring, and escalation protocols for emerging supplier risks. We align supplier risk management with AS9100, SCMG requirements, and MOD supply chain assurance expectations.
Risk Management Maturity Assessment
WHG assesses your current risk management maturity across five dimensions before designing an improvement programme. The assessment produces a maturity score, gap register, and prioritised roadmap — typically completed within two weeks.
Risk Identification
Risks identified reactively when problems arise. No structured methodology or register.
Some risks documented but identification is inconsistent and coverage is incomplete.
Structured risk identification process. Risk register maintained across key areas.
Comprehensive risk identification across all dimensions. Workshops conducted regularly. Register reviewed quarterly.
Horizon-scanning and emerging risk processes in place. Risk identification embedded in all planning activities.
Risk Assessment
No consistent assessment methodology. Severity judged informally.
Consequence/likelihood matrix used inconsistently. Scoring not calibrated to defence context.
Documented assessment methodology. Consistent scoring applied. Risk appetite defined.
Assessment methodology aligned to JSP 892 and ISO 31000. Risk appetite approved by board.
Quantitative and qualitative assessment used. Assessment methodology reviewed and updated annually.
Mitigation & Controls
Controls implemented informally. No documented mitigation plans.
Mitigation actions recorded but not consistently monitored or evidenced.
Control register maintained. Mitigation plans documented with owners and due dates.
Control effectiveness monitored. Residual risk formally accepted. Def Stan alignment documented.
Controls tested and assured. Residual risk trends analysed. Control gaps drive improvement plans.
Governance & Reporting
No risk reporting structure. Board has no visibility of risk position.
Occasional risk updates to senior management. No formal reporting cadence.
Regular risk reporting to senior management. Escalation protocol defined.
Board risk dashboard. JSP 892-aligned governance. Risk committee or equivalent in place.
Board actively challenges risk position. Risk governance integrated with compliance and audit frameworks.
Supply Chain Risk
Supplier risk not formally managed. No qualification or monitoring process.
Key suppliers identified but risk assessment is inconsistent. No ongoing monitoring.
Supplier risk assessment at qualification. Annual review for critical suppliers.
Tiered supplier risk programme. Ongoing monitoring. Escalation protocol for emerging supplier risks.
Integrated supply chain risk programme aligned to AS9100 and SCMG. Supplier risk feeds board risk register.
Request a Risk Management Maturity Assessment
WHG conducts a structured assessment across all five dimensions, producing a maturity score, gap register, and prioritised improvement roadmap — typically completed within two weeks.
Real-World Risk Scenarios
The risk management challenges WHG addresses are grounded in the realities of defence contracting. These scenarios reflect the situations our clients most commonly face.
Scenario 01
Contract Award — JSP 892 Risk Management Requirement
The Situation
A defence engineering company is shortlisted for a significant MOD contract. The ITT requires evidence of a risk management framework aligned to JSP 892, including a documented risk register, risk appetite statement, and board-level risk governance.
The Challenge
The organisation manages risks informally. There is no documented risk register, no risk appetite statement, and no board reporting structure. The ITT submission deadline is six weeks away.
The WHG Approach
WHG conducts an accelerated risk management implementation — facilitating a risk identification workshop, building a JSP 892-aligned risk register, drafting a risk appetite statement for board approval, and designing a board risk reporting pack. The complete risk governance evidence pack is prepared for ITT submission.
Outcome
ITT submitted with full risk governance evidence pack. Contract awarded. Risk management framework adopted as the organisation's standard operating model.
Scenario 02
ISO 27001 Surveillance — Information Security Risk Non-Conformance
The Situation
An organisation receives a major non-conformance at ISO 27001 surveillance audit. The finding: the information security risk assessment has not been updated following a significant change to the IT environment, and there is no evidence of risk treatment plan review.
The Challenge
The ISMS risk assessment was last updated 18 months ago. Three significant IT changes have occurred since then, none of which triggered a risk reassessment. The certification body has given 90 days to close the non-conformance.
The WHG Approach
WHG conducts an immediate information security risk reassessment covering all changes to the IT environment, updates the risk treatment plan, implements a change-triggered risk review process, and produces the corrective action evidence required for the certification body.
Outcome
Non-conformance closed within five weeks. Change-triggered risk review process embedded in the ISMS. No recurrence at subsequent surveillance audit.
Scenario 03
Supply Chain Failure — Tier-Two Supplier Risk
The Situation
A prime contractor discovers that a tier-two supplier has lost its ISO 9001 certification following a failed surveillance audit. The supplier provides a critical component for an active MOD contract. The prime contractor has no documented supplier risk management process.
The Challenge
The prime contractor has no visibility of tier-two supplier compliance status. There is no contingency plan for supplier failure. The MOD contract programme is at risk of delay.
The WHG Approach
WHG conducts an emergency supplier risk assessment, identifies alternative qualified suppliers, supports the prime contractor in notifying the MOD, and designs a supplier risk monitoring framework to prevent recurrence — including ongoing compliance status tracking for all critical tier-two suppliers.
Outcome
Alternative supplier qualified within three weeks. Contract programme maintained. Supplier risk monitoring framework implemented across the full critical supplier base.
“WHG transformed our approach to risk management. We went from a spreadsheet that nobody looked at to a live risk governance framework that our board actively uses. Our MOD contract monitor specifically noted the improvement at our last programme review.”
Programme Director, UK Defence Prime Contractor
Build a Risk Management Programme That Satisfies Defence Requirements
Whether you are implementing risk management for the first time or strengthening an existing programme, WHG provides the expertise and practical support to build a framework that satisfies MOD requirements and creates genuine organisational resilience.
Speak to Our Risk Team