Components of risk: connect sources, events and consequences

A clear risk discussion separates what could give rise to an event, the event itself and the consequences that could follow. The diagram above uses a bow-tie to show these connections and the places where controls can act.

The distinction matters because each part raises a different question. A broad label such as “service failure” can hide several possible events, causes and effects that need different responses.

Read the diagram from left to right

• Sources: conditions, hazards, actors or opportunities that could give rise to an event.

• Event: the occurrence or change in circumstances being considered.

• Consequences: the effects that could follow and matter to the objectives being assessed.

• Likelihood controls: measures acting on pathways leading to the event.

• Consequence controls: measures acting on what follows the event.

Escalation factors are conditions that affect a control’s effectiveness. Measures that manage those conditions help sustain the control. The labels describe different functions; they are not proof that a particular safeguard works.

Follow one credible pathway

Imagine a fictional service team that depends on a booking system. A loss of power could make the system unavailable, which could interrupt bookings and delay customer service.

A suitable power arrangement may affect the pathway to the outage. A prepared manual process may affect the consequences after the system becomes unavailable. The manual process must be designed and practised beforehand even though it is used after the event.

That example does not cover every possible system failure. A control that addresses one cause may do little for another. Follow the mechanisms that are relevant to the actual situation.

Connect the explanation to action

For one current risk, identify the objective, describe the event and trace one plausible source-to-consequence pathway. Then ask what each control is intended to do, who maintains it and what evidence shows it operates under the relevant conditions.

Keep assumptions and uncertainty visible. Adding more boxes does not establish that the controls are independent, effective or sufficient. The purpose of the diagram is to make the reasoning and the next questions easier to examine.

Adapted from the terminology chapter of Risk Management Body of Knowledge, by Julian Talbot, Jason Brown and Miles Jakeman, AM. The booking-system example is fictional.

Put the body of knowledge to work

Explore the Risk Management Body of Knowledge for the connected principles, frameworks and methods behind this article.

Considering a shared reference for your team? Enquire about organisational use and tell us how you would use RMBOK.