A risk rated “high” may still leave managers unsure whether to invest, defer or accept it. This service starts with a pending decision and organizes objectives, available information and treatment options so that assessment can support resource allocation and follow-up.
Who may consider this and when
Organizations whose departments use risk registers with scores that cannot be compared, or that are considering investments, new projects or process changes, can pilot the approach on an issue requiring a shared decision. Participants should include people who perform the work and people authorized to approve resources.
Common challenges
Different departments may score the same event differently because they use different consequences or time horizons. More detailed scores are not necessarily more credible when criteria are unexplained. A treatment field that says only “continue to monitor” does not clarify who must act or under what conditions.
Approach and applicable requirements
ISO 31000:2018 provides guidance on risk-management principles, framework and process, and can be applied to governance and operations in context. It is not a requirements standard for obtaining independent management-system certification. ISO catalogue
Potential work topics include:
- Set risk criteria from objectives: Confirm what the organization seeks to protect or achieve, acceptable conditions and escalation authority before defining consequence scales.
- Assess with evidence and compare options: Distinguish causes, events, effects, existing controls and data uncertainty; compare treatment cost, benefit and residual risk.
- Connect monitoring and communication: Link decisions to budgets, projects or routine meetings, with data updates and triggers for significant change so risk is not reviewed only once a year.
Support and work stages
Define one pending decision
Confirm objectives, time horizon, responsibilities and missing information before building a full risk matrix.
Calibrate assessment scales
Use the same scenario with relevant departments to discuss differences, document criteria and identify where specialist methods are needed.
Present comparable treatment options
List alternatives, resources, constraints and residual risks for an authorized decision-maker to accept or select.
Connect decisions to follow-up
Agree on owners, milestones and review triggers; check whether actions changed the original assessment.
Suggested outputs include risk criteria, assessment and assumption records, a treatment-option comparison and a decision tracker. A review should show how a risk changed resource allocation and who approved the residual risk.
Information to prepare
- Business or project objectives, pending decisions and decision deadlines.
- Risk registers, past events and relevant external changes.
- Existing controls, authority and responsibility assignments.
- Budget options, action progress and management-meeting records.
Start with an information index and de-identified samples. Confirm purpose, access and retention arrangements before sharing project information.
Schedule and fees
Effort depends on decision scope, participating departments, data maturity and methodological complexity. Quantitative models, specialist technical analysis and legal judgments require separate resources. Completing a single risk form does not demonstrate that a full system is operating.
Frequently asked questions
Must we use a 5-by-5 matrix?
Choose tools to suit the data and decision. Criteria and reasons should be understandable and consistently reusable.
Is risk only about loss?
Risk concerns the effect of uncertainty on objectives. Discussion may include opportunities, but the assessment and treatment still need to be explicit.
Can all ISO systems use the same risk form?
Governance and follow-up arrangements may be shared, but specialist criteria for information security, occupational safety and other fields should not be forced into identical scores.
Who can accept residual risk?
An authorized company decision-maker. Assessment supports the decision but cannot make it on the company's behalf.
Does completing an assessment guarantee no loss?
Assessment is limited by information and context. Its value is better judgment and timely adjustment, not a guaranteed outcome.
How often should risks be reviewed?
Set a cadence based on risk changes and decision cycles. Major changes in assumptions, business or external conditions should also trigger review.
Related services and enquiries
Bring one issue awaiting management decision, together with the current risk view and resource options. Contact Captain International