Two assessors can agree on the facts and still disagree about what matters. One may focus on cost, another on continuity, and a third on the people affected. Risk criteria make those judgements explicit enough to discuss and use. Criteria are the reference points for evaluating the significance of risk and informing decisions. They should reflect the organisation’s objectives, obligations, resources and approach to taking risk. Begin with the choice Consider a fictional team

Check external conditions, internal capability and assessment arrangements before reusing a risk assessment. Includes a practical change record.

Some risk questions call for reliable data. Others require people to adapt as competitors, suppliers or hostile actors change their behaviour. A method that works well in one setting may answer the wrong question in another. Julian Talbot’s 3A model offers three useful prompts: actuarial, active and adversarial risk. These are not exhaustive or mutually exclusive categories. Their purpose is to help you choose and combine methods. Actuarial: what can relevant observations tel