Risk management and assessment in direction, planning and improvement
Risk is uncertainty of outcome
Risk is a possible event that could cause harm or loss, or make achieving objectives harder - but it also covers uncertainty of opportunity. Nothing in DPI is risk-free: direction commits resources, planning makes assumptions, and improvement changes systems that already work.
Risk management is the practice of identifying, assessing and controlling risk. The assessment stage is commonly split into identification (what could happen, and to which objective), analysis (likelihood and impact, considering existing controls) and evaluation (compare against appetite to decide whether action is needed). Treatment options include avoiding the activity, mitigating (reducing likelihood or impact), transferring or sharing (insurance, contracts, partners) and retaining or accepting the residual risk. Controls implement the chosen treatment and must be monitored.
Every candidate should distinguish risk appetite (how much risk the organization is willing to seek or accept in pursuit of objectives), risk tolerance (deviation from appetite the organization can live with) and risk capacity (the maximum risk it could bear before failing). These are regularly confused in questions. A risk register records risks, owners, ratings and treatment status.
Traps: assuming the goal is zero risk; treating assessment as a one-off at project start; ignoring that assessment should be proportionate to the size of the decision; assuming risk management is only the risk team's job.
Rule of thumb: for any plan or improvement ask, 'what must be true for this to succeed, and what would break it?' The answers are your risks and assumptions, each with an owner.