Category: Enterprise Risk Management
Communication and Consultation
Also known as: Consultation and Communication
Simply put
Communication and consultation is the ongoing process of sharing information about risk with the people affected by it and seeking their input. Communication focuses on promoting awareness and understanding of risk, while consultation involves actively gathering feedback and working together to identify concerns and find solutions.
Formal definition
Communication and consultation refers to the continual and iterative activities an organization undertakes to provide, share, or obtain information and to engage in dialogue with internal and external stakeholders throughout the risk management process. In common usage, communication denotes efforts to promote awareness and understanding of risk, whereas consultation denotes obtaining feedback and input to inform decisions. In workplace health and safety contexts, this commonly includes identifying hazards and risks, raising health and safety concerns, and collaborating to develop solutions, applied at both individual and collective levels. The specific obligations, avenues, and required practices vary by jurisdiction, sector, and applicable framework, and this entry does not cover implementation specifics or legal requirements.
Why it matters
Communication and consultation are widely treated as a continual, cross-cutting activity within the risk management process rather than a discrete stage. Risk decisions rely on information held by different stakeholders, and without structured dialogue an organization may misjudge the nature of a risk, overlook affected parties, or implement treatments that fail because those closest to the risk were not engaged. Distinguishing the two terms matters: communication promotes awareness and understanding of risk, while consultation actively gathers feedback and input to inform decisions. Conflating them can lead organizations to broadcast information while assuming they have consulted, when in practice no meaningful input has been sought.
Who it's relevant to
Risk managers and risk practitioners
Those responsible for the risk management process rely on communication and consultation to gather the stakeholder input needed to assess risk accurately and to build the shared understanding required for risk treatments to be accepted and effective. They typically design the avenues through which information is shared and feedback is obtained across the process.
Workplace health and safety personnel
In health and safety contexts, communication and consultation commonly involve identifying hazards and risks, raising concerns, and working together to find solutions at both individual and collective levels. Safety practitioners use these activities to engage affected workers, though the specific consultation obligations depend on the applicable jurisdiction and regime.
Internal and external stakeholders
Individuals and groups affected by a risk, whether inside the organization or beyond it, are both recipients of communication about risk and participants in consultation. Their input helps surface concerns that may not otherwise be visible to decision-makers and supports coordination of duties where responsibility is shared.
Governance and oversight functions
Those with oversight of the risk management process have an interest in whether communication and consultation are occurring in a continual and iterative manner, rather than as one-off exercises, since gaps in stakeholder engagement can undermine the quality of risk information reaching decision-makers.
Inside Communication and Consultation
Communication
The provision, sharing, or transfer of information to internal and external stakeholders about risk, its management, and related decisions. In many risk management frameworks, such as ISO 31000 issued by the International Organization for Standardization, communication is characterized as a two-way or multidirectional flow rather than a one-way dissemination of messages.
Consultation
A process of obtaining feedback and information from stakeholders to inform decisions, distinguished from communication in that it seeks input into decision-making rather than simply conveying an outcome. Consultation typically informs judgment but does not, by itself, transfer accountability for the resulting decision.
Stakeholder identification
The activity of determining which internal and external parties have an interest in, or are affected by, risk and its management. The relevant stakeholders commonly vary by jurisdiction, industry, and organizational context, so the scope of engagement is typically defined case by case.
Integration across the process
In several frameworks, communication and consultation are treated as a continuous activity intended to support all stages of the risk management process rather than a discrete, one-off step. This positioning aims to keep stakeholder perspectives available throughout risk identification, assessment, and treatment.
Governance and assurance linkage
Communication and consultation spans more than one GRC pillar: it supports governance by informing decision rights and reporting lines, and it supports risk management by surfacing information relevant to identifying and assessing uncertainty. The entry does not, however, treat consultation as an assurance activity; independent assurance functions maintain their objectivity separately from the management activities being informed.
Common questions
Answers to the questions practitioners most commonly ask about Communication and Consultation.
Is communication and consultation just about informing stakeholders once risk decisions have been made?
No. Communication and consultation is commonly described as a continuous, two-way process that runs throughout the risk management activity, not a one-off notification at the end. Communication typically involves sharing information to raise awareness and understanding, while consultation involves obtaining feedback and input that can inform decisions. Treating it solely as downstream messaging misses the consultative element, in which stakeholder views may shape how risks are identified, assessed, and treated.
Does consultation mean that stakeholders share responsibility for the risk decision itself?
Not typically. In many frameworks, consultation is an input-gathering activity that helps decision-makers understand different perspectives, expertise, and interests. Accountability for the risk decision generally remains with those holding the relevant authority and decision rights within the governance structure. Consultation informs a decision; it does not, on its own, transfer or dilute the accountability that sits with management or the responsible body.
At what points in the risk management process should communication and consultation take place?
It is commonly positioned as an activity that supports the process throughout rather than at a single stage, spanning establishing context, risk identification, analysis, evaluation, treatment, and monitoring. Organizations often plan touchpoints at each of these stages so that stakeholder input is captured before decisions are finalized and so that outcomes are communicated afterward. The specific cadence and points typically depend on the organization's process design and the significance of the risks involved.
How can an organization identify which stakeholders to consult?
A common approach is to consider parties who may affect, be affected by, or perceive themselves to be affected by the relevant risks, which can include internal functions and external parties. Mapping stakeholders by their interest, influence, and expertise can help prioritize who to engage and to what depth. The appropriate set of stakeholders generally varies by the nature of the risk, the organization's structure, and any applicable jurisdictional or sectoral expectations, so this entry does not prescribe a fixed list.
How should communication and consultation activities be recorded?
Organizations commonly maintain records of what was communicated, to whom, when, and what input was received, so that the basis for decisions is traceable. Documentation practices may include engagement plans, meeting records, and summaries of feedback and how it was considered. The level of formality typically depends on the significance of the risk and any governance or regulatory expectations that apply; this entry does not address specific tooling or document formats.
How can communication and consultation be made effective rather than a procedural formality?
Effectiveness is often supported by tailoring the format and language to the audience, engaging stakeholders early enough for their input to influence outcomes, and demonstrating how feedback was considered. Clarity about the purpose of each engagement and about who holds decision rights can help avoid confusion between consulting on a matter and deciding it. Because outcomes depend on organizational context and culture, these are general practices rather than guarantees of an effective process.
Common misconceptions
Communication and consultation are the same activity.
They are related but distinct. Communication commonly refers to sharing or transferring information with stakeholders, whereas consultation seeks input from stakeholders to inform a decision. Consultation involves obtaining feedback that shapes judgment, while communication may be limited to conveying information or outcomes.
Communication and consultation is a single step performed at the start or end of the risk process.
In many frameworks it is positioned as a continuous activity intended to support all stages of the risk management process, rather than a discrete phase carried out only once.
Consulting stakeholders transfers responsibility for the decision to those stakeholders.
Consultation typically informs a decision but does not, on its own, shift accountability. The party with the relevant decision rights generally remains accountable for the outcome, consistent with the governance distinction between seeking input and holding decision authority.
Best practices
Identify relevant internal and external stakeholders explicitly, recognizing that the appropriate scope commonly varies by jurisdiction, industry, and organizational context.
Distinguish clearly between communication and consultation when planning engagement, being explicit about where you are conveying information and where you are seeking input that will influence a decision.
Treat communication and consultation as a continuous activity woven through the risk management process rather than a single step performed only at the beginning or end.
Enable two-way or multidirectional information flow so that stakeholder perspectives can be surfaced and considered, rather than limiting engagement to one-way dissemination.
Clarify decision rights and accountability so that consultation informs judgment without ambiguity about who remains responsible for the resulting decision.
Preserve the independence of assurance functions by keeping consultation that informs management activities separate from objective assurance over those activities.
