A software team worries about a security hole. A building site worries about a fall from scaffolding. A bank worries about a failed payment system. These are very different dangers, but all three teams manage them in surprisingly similar ways.
In this article we look at how five industries handle risk management: what they fear most, which rules they follow, and one habit from each that any team can borrow. New to the topic? Start with What Is Risk Management, and How Do Teams Actually Do It?
Risk management by industry, at a glance
| Industry |
Biggest worries |
Common standard or method |
How risks are scored |
How often risks are reviewed |
Who usually owns them |
| Software and IT |
Security breaches, outages, missed releases |
NIST Risk Management Framework |
Probability × impact matrix; severity scores for security flaws |
Every sprint or release |
Engineering lead; security lead for security risks |
| Construction |
Injuries, delays, cost overruns |
ISO 45001 (health and safety) |
Likelihood × severity matrix in written risk assessments |
Daily on site, weekly for the project |
Project manager and site safety officer |
| Healthcare and pharma |
Patient harm, product quality, failed inspections |
ISO 14971 (devices), ICH Q9 (medicines) |
Each company sets its own acceptance criteria; FMEA is common |
Across the product's whole life, including after launch |
Quality and regulatory teams |
| Financial services |
System failures, fraud, compliance breaches |
Basel rules on operational risk; the Three Lines Model |
Team self-assessments plus warning indicators that are tracked over time |
Continuously, with regular board reviews |
A separate risk team, checked by internal audit |
| Manufacturing |
Supplier delays, defects, recalls |
FMEA (failure mode and effects analysis) |
Severity, occurrence and detection rated for each failure |
Whenever a design or process changes |
Quality engineers and supply chain managers |
Scoring methods, review rhythms and owners are typical patterns, not fixed rules. Every organization sets its own. This article is a general overview, not compliance advice: always check the current standard and your regulator's guidance.
Software and IT: risk moves at the speed of releases
Software teams change their product every few weeks, so their risks change just as fast. A new feature can open a security gap. A library update can break a release. Security teams often follow the NIST Risk Management Framework, which builds risk checks into every stage of a system's life.
Example: a login library the team relies on has a known security flaw. The team rates it High, patches it in the current sprint, and re-rates it Low.
Lesson to borrow: review risks in the same rhythm as the work. If you plan every two weeks, look at your risks every two weeks too.
Construction: everyone on site is a risk spotter
On a building site, a missed risk can cost a life, so safety comes first. Work at height, heavy lifting and bad weather are everyday dangers. Many firms follow ISO 45001, where finding hazards and assessing them sits at the center. Short safety briefings before work starts are common, and workers are expected to speak up.
Example: strong winds are forecast on the day of a crane lift. The supervisor moves the lift to a calmer day and records why.
Lesson to borrow: make it easy for anyone to raise a risk, not just the manager.
Healthcare and pharma: risk doesn't stop at launch
When the product is a medical device or a medicine, the main risk is harm to patients. Regulators expect a clear record of every risk and every decision. Device makers follow ISO 14971, which the US FDA recognizes, and drug makers follow ICH Q9 on quality risk management. Risks are tracked before a product reaches patients and after it is on the market.
Example: testing shows a device's alarm may be too quiet on a busy ward. The maker changes the design, then keeps checking user complaints after launch.
Lesson to borrow: keep watching risks after the launch. The real world always finds problems the plan missed.
Financial services: the doers and the checkers
Banks face "operational risk", which the Basel Committee defines as loss from failed processes, people or systems, or from outside events. Think of a payment system going down or a fraud slipping through. Many banks split the work using the IIA's Three Lines Model: business teams own their risks, a separate risk team challenges them, and internal audit checks the whole system.
Example: a payment system runs from a single data center. The business team adds a backup site, the risk team questions the plan, and internal audit later tests that the switch-over works.
Lesson to borrow: have someone outside the team look at your risk list now and then. Fresh eyes catch what the team has stopped seeing.
Manufacturing: ask how each step could fail
Factories depend on long supply chains and precise processes. One late supplier or one faulty part can stop a line or trigger a recall. Many manufacturers, especially in automotive, use FMEA (failure mode and effects analysis). The team walks through each step of a design or process and asks: how could this fail, how bad would it be, and how would we notice?
Example: one supplier makes a critical part. The team approves a second supplier and adds a quality check when parts arrive.
Lesson to borrow: for every big risk, ask how you would spot it early. A risk you can see coming is a risk you can still fix.
What every industry has in common
The dangers are different, but the habits are the same. In every industry, the teams that manage risk well:
- Follow the same loop: identify, assess, respond and review.
- Use one shared scale, so everyone rates risks the same way.
- Name an owner for every serious risk.
- Review on a fixed rhythm, whether that is daily, every sprint or every quarter.
- Keep a record of what they decided and why.
The hard part is not knowing these habits. It is keeping them up week after week, often with tools that were never built for the job. Risk Manager for Jira helps by scoring your Jira work items on probability and severity, showing them on a color-coded risk matrix, and tracing each risk to its mitigation.
Frequently asked questions
Which risk management standard should my team follow?
It depends on your industry. Regulated teams usually must follow their sector's standard, such as ISO 14971 for medical devices. Other teams can use ISO 31000 as general guidance without any certification.
Does every industry use a risk matrix?
Most use some form of probability × severity grid. But not all: manufacturers often use FMEA, and banks add warning indicators. ISO 14971 doesn't require a matrix at all; it asks each company to define when a risk is acceptable.
Can a small team use these methods?
Yes. You don't need a compliance department to borrow the habits above. Review on a rhythm, invite everyone to raise risks, keep watching after launch, get fresh eyes, and ask how you would spot trouble early.
Why do regulated industries keep such detailed records?
Because auditors and regulators want to see each decision: what the risk was, how it was rated, what was done, and how the rating changed. Teams outside regulated industries benefit from the same record when something goes wrong.
Next in the series: where spreadsheets break down: why spreadsheets and documents stop working as a home for your risks, and the signs your team has outgrown them.