Write a risk treatment someone can carry out
“Improve training.” “Review the process.” “Strengthen controls.”
These may be reasonable intentions, but they leave the person responsible to work out what was actually agreed. A useful risk treatment connects a defined risk to an action, an owner, the necessary resources and evidence of completion and performance.
The RMBOK adapts the 4A approach from audit recommendations to help test whether a treatment is appropriate, actionable, achievable and agreed.
Appropriate: does it address the risk?
Start with the scenario or consequence you want to change. Then explain how the proposed action could affect it and whether it fits the objectives and risk criteria.
If incomplete handovers cause work to be missed, “send everyone on a general communication course” might not address the actual weakness. The issue could be an unclear handover requirement, a system that loses attachments or a workload that leaves no time for the task.
A familiar solution still needs a reason to be selected.
Actionable: can someone see what to do?
Name the action and the person accountable for it. Include the relevant date, required approvals and dependencies.
Compare these fictional instructions:
Improve handovers between teams.
By 30 October, the operations manager will introduce an agreed handover checklist for the day and evening support teams, brief both teams on its use, and nominate who accepts each handover.
The second instruction is easier to act on. It still needs resources and a way to evaluate the result.
Achievable: are the means and evidence clear?
Check that the owner has the authority, time and capability to complete the action. Identify the work required from others. If resources are unresolved, record that instead of presenting the action as an unconditional commitment.
Distinguish completing the task from achieving its purpose. Issuing the checklist shows it was issued. It does not show that important work is no longer lost between teams.
For the example, the manager could review a defined sample of handovers over an agreed period, check whether the necessary information and acceptance records are present, and investigate omissions. The sample, acceptance criteria and review responsibility must be settled for the actual situation. No sample size or success threshold fits every context.
Agreed: has responsibility been accepted?
A name in a spreadsheet does not establish agreement. Confirm that the action owner and responsible decision-maker accept the commitment, including its resources and timing. Record material concerns or unresolved disagreement.
For the handover example, both team leads need to understand their role. If the proposed timing is impractical, that is a decision to resolve before the action becomes overdue.
Use a short treatment record
Risk and purpose: The scenario, pathway or consequence the action addresses.
Action and owner: What will change and who is accountable.
Deadline and dependencies: When it is due and what must happen first.
Resources and authority: The capability, time, funding and approvals needed.
Evidence: How completion and performance will be checked.
Agreement and review: Who accepted the commitment and when the result will be reviewed.
The record can be brief when the action is straightforward. A complex treatment may need a supporting plan. The 4As help structure the recommendation; they do not prove it will work.
If the decision is to retain the risk without adding a new treatment, record the rationale, authority, owner and review conditions. Continuing controls or monitoring may still be needed. A clear decision record can be more useful than inventing an activity simply to fill an action column.
Based on section 5.5.2 of Risk Management Body of Knowledge, by Julian Talbot, Jason Brown and Miles Jakeman, AM. The handover example and date are illustrative.
Put the body of knowledge to work
Explore the Risk Management Body of Knowledge for the connected principles, frameworks and methods behind this article.
Considering a shared reference for your team? Enquire about organisational use and tell us how you would use RMBOK.