Risk
Risk
The Risk theme tests whether risks are identified, assessed, and controlled so they do not silently threaten the business case. A risk is an uncertain event that, if it occurs, affects objectives. Describe it as cause-event-effect. The risk management approach defines risk appetite, tolerance, roles, and techniques. The risk register records each risk, its cause, effect, probability, impact, proximity, owner, actionee, response, and status. Assess probability and impact, then expected value where useful. Responses include avoid, reduce, transfer, accept, share, exploit, enhance, and reject. A risk owner owns the risk; a risk actionee carries out the response. A risk budget can fund contingent actions.
Worked example
A hardware supplier may miss delivery because of customs delays. Cause: incomplete export paperwork. Event: customs holds the shipment. Effect: installation slips ten days. Probability is 40%; impact is ten days against a five-day float. The response is reduce: pre-clear paperwork and use a broker. The risk owner is the procurement lead; the actionee is the logistics officer. The residual risk is logged at 15% probability and three days' impact. Reasoning: the response changes probability and impact, and ownership is explicit.
Traps
Do not call an event that has already happened a risk; it is an issue. Do not confuse risk owner with risk actionee. Do not treat transfer as eliminating risk; reputational or schedule effects may remain. Do not use accept to mean ignore; acceptance must be authorised and monitored. Do not set risk appetite and risk tolerance as the same thing.