Agree your risk criteria before comparing options
Two assessors can agree on the facts and still disagree about what matters. One may focus on cost, another on continuity, and a third on the people affected. Risk criteria make those judgements explicit enough to discuss and use.
Criteria are the reference points for evaluating the significance of risk and informing decisions. They should reflect the organisation’s objectives, obligations, resources and approach to taking risk.
Begin with the choice
Consider a fictional team choosing between two ways to launch a service. A rapid launch could reach customers sooner but require temporary manual work. A staged launch could allow more testing but delay expected benefits.
Before scoring either option, agree what success requires. Which service commitments must be maintained? What resources are available? What adverse effects require escalation? Which benefits justify taking additional uncertainty?
Some constraints are requirements; others are preferences or tradeoffs. Identify their source and who has authority to interpret or change them. A convenient score should not silently replace an obligation.
Define the comparison
A useful set of criteria answers practical questions:
Which objectives and types of consequence are included?
What event or outcome are we estimating, over what period?
What do the likelihood and consequence descriptions mean?
Which limits, ranges or conditions require further action?
Who may accept the remaining exposure, and who must be consulted?
How will shared dependencies and combined exposures be considered?
Use a consistent basis. The likelihood of disruption during a launch weekend is not directly comparable with the likelihood of disruption over a year. A cost described as a percentage also needs a defined denominator, such as the same approved budget.
Qualitative descriptions can be useful, but people must understand them similarly. Adding numbers to vague words does not resolve the underlying ambiguity.
Distinguish appetite, tolerance and capacity
Risk appetite concerns the amount and type of risk an organisation is prepared to take in pursuing objectives. Tolerance translates that broad position into acceptable limits or variation in performance and exposure. Capacity concerns what the organisation can bear.
These can differ by objective. The service team may be willing to experiment with a new delivery method while accepting very little avoidable exposure involving sensitive customer information. Describing the whole organisation as simply “risk-taking” would conceal that distinction.
Consider upside as well as loss. Strong demand may be desirable, but the team still needs the capacity to deliver what it promises. Benefits, obligations and operational limits belong in the same decision.
Write criteria people can use
Try this structure for one important condition:
For [objective and period], we will assess [measure or description] using [evidence]. [Limit or condition] requires [response], decided by [authority].
Test it against both launch options. If two people cannot apply it consistently, clarify the definitions or evidence requirements before treating their scores as comparable.
Review criteria when objectives or conditions materially change. Record the reason and approval so later readers can distinguish a changed decision basis from a changed risk estimate.
Based on section 5.3.3 of Risk Management Body of Knowledge, by Julian Talbot, Jason Brown and Miles Jakeman, AM. The service-launch example is fictional.
Put the body of knowledge to work
Explore the Risk Management Body of Knowledge for the connected principles, frameworks and methods behind this article.
Considering a shared reference for your team? Enquire about organisational use and tell us how you would use RMBOK.