Risk Treatment, Risk Recording and Reporting
Domain 4 - Risk treatment, risk recording and reporting
This domain tests whether you can turn an evaluation into a defensible, owned and documented action plan, and record and report it so decisions are traceable.
Core rules
- Treatment options include avoiding the risk, taking or increasing the risk to pursue an opportunity, removing the risk source, changing likelihood, changing consequence, sharing the risk (contracts, insurance, partnerships), and retaining the risk by informed decision.
- Selection weighs cost, effort, benefits, legal and regulatory obligations, stakeholder views and values - not cost alone.
- A treatment plan states rationale, the responsible person, resources, performance measures, timing, expected effect on the risk level, and monitoring arrangements. The risk owner remains accountable after sharing or outsourcing.
- After implementation, residual risk is re-evaluated against criteria; if still above tolerance, iterate or escalate to the authority empowered to accept it.
- Recording captures purpose, scope, criteria, method, assumptions, data sources, results, decisions, owners and dates. Reporting tailors content, frequency and format to the audience - board, operational management, regulators, external stakeholders - within confidentiality and legal constraints.
Worked example
A single-supplier component risk is evaluated as unacceptable. Qualifying a second supplier changes likelihood; holding buffer stock reduces consequence; insurance covers financial loss but not lost reputation. The plan names the supply manager, milestones, a supplier-qualification measure and quarterly review. Residual risk is re-scored and, if still above tolerance, is escalated for a documented acceptance decision by the accountable executive.
Traps that cost marks
- Writing
mitigate the riskas a treatment with no option, owner, date or measure. - Accepting residual risk at a level where the person has no authority to do so.
- Recording results without decisions, assumptions or owners, making the register useless for audit and learning.
- Treating treatment as complete once a control is installed, without verification.