First you need to understand what are you risk exposures, see them from different angles, measure them, compare them and communicate accross the organization in an organized and effective manner the rules for measuring an d reporting risks. Embed into the company culture the risk elements that need to be considered in all decisions.

Constantly monitor the risks identified and periodically review the risk matrix and scan for the occurrence of new risks and their characteristics

Risk management is a process not a snapshot in time.

This in effectively preparing for the unexpected and the unthinkable.

After you have identified the risks you can do a few things with them: Treat, Transfer, Tolerate or Terminate. Treat is the first thing you want to do with risks and the organizations is doing the treatment in two steps basically.

Preventive treatment - meaning that the company is trying to find technical, technological, procedural, legal, contractual or any other ways of mitigating the risk exposures identified on one way and on the other way

Post Factum treatment - which is sum of actions and measures aimed at reducing the effects of events that were identified as risk exposures after they happen.

After the deep analysis is finalized a brief summary needs to be prepared for quick review and this is either a risk criticality matrix or a risk map showing probabilities, and magnitudes of exposures.

Summarizing all insurance policies with benchmarking in terms of types of cover, good market practice, costs, and effectiveness of policies, administration and design.

The Bridge report is following the Risk Evaluation and insurance Audit and highlights the gaps between the risks and the responses taken by the organization in Transferring and Treating the risks