What changed? Establish the context before reusing an assessment
Last year’s assessment may contain useful work. Before reusing its conclusions, check whether the conditions that supported them still apply.
Context is more than introductory background. It includes the objectives, people, operating conditions and arrangements that shape the decision. Changes in those conditions can alter scenarios, controls and the relevance of evidence.
Look outside the organisation
A structured scan can reveal external changes that familiar routines conceal. PESTLE provides six prompts: political, economic, societal, technological, legal and environmental factors.
You do not need six long essays. Identify what matters to the decision, then explain its effect. For a fictional service provider assessing a new location, a change in transport access may affect staff availability and response times. A new technology may create an opportunity to serve customers differently while introducing unfamiliar dependencies.
Distinguish a verified change from an assumption or an emerging possibility. Record the evidence and how soon the issue could matter. A long list of general trends is less useful than a clear account of the few that could change the choice.
Check what changed inside
Internal context includes objectives, culture, systems, resources, technology, accountability and relationships. A procedure may be unchanged while the people and capacity needed to carry it out have changed substantially.
Consider a service team whose previous assessment assumed two experienced supervisors were always available. One has moved to another role, and the replacement is still learning. Reusing the old description of supervision would hide a material change in capability.
Check interfaces as well as individual departments. A control that appears sound within one team may depend on information, approval or support from another team working to different priorities.
Clarify the assessment arrangements
Risk management context also concerns how the work will be done. Agree the methods, responsibilities, resources, records and decision authority relevant to the assignment.
Ask whose interests are affected and who can contribute evidence. Stakeholder consultation can reveal consequences that management has not recognised. It does not guarantee agreement; record important differences instead of presenting them as a single shared view.
Material issues outside the agreed scope should be raised and referred or included through the appropriate decision. A narrow assignment should not make an important dependency disappear.
Keep a short change record
Use these fields when reviewing an existing assessment:
What changed? Describe the condition and when it changed.
What supports that account? Name the evidence and remaining uncertainty.
Why does it matter? Connect the change to an objective, scenario, control or assumption.
What needs review? Identify the affected analysis or decision.
Who will act, and when? Assign the next step and any escalation.
For the supervision example, the action might be to verify cover and competence before retaining the earlier control assessment. The answer could be a revised arrangement, further evidence or a different operating decision; it should not be assumed in advance.
Keep the record proportionate and revisit it when conditions change. Its value lies in helping people decide which parts of the assessment still deserve confidence.
Based on section 5.3.2 of Risk Management Body of Knowledge, by Julian Talbot, Jason Brown and Miles Jakeman, AM. The service-provider examples are fictional.
Put the body of knowledge to work
Explore the Risk Management Body of Knowledge for the connected principles, frameworks and methods behind this article.
Considering a shared reference for your team? Enquire about organisational use and tell us how you would use RMBOK.