You first decide the risk appetite of the business. Then you write a risk management policy. Next you create a risk register. With these tools in place conduct your first risk identification meeting and identify your business risks. Write them down in the risk register. Share them with senior management. Manage the risks through the risk management process.