From a static list to a working picture.
-
Map it. Start with what's known.
Broad risks broken into specific ones, each with an owner.
-
Rate it. How likely, and how much impact.
Every risk is rated, and the organization sets how much of it is acceptable.
-
Test it. Reality checks the ratings.
Every incident links to a risk. When a risk rated as unlikely keeps happening, it shows.
-
Plan for it. Not every risk is a threat.
A new site, a new service or a new partnership carries risk worth managing too. Strategic risks sit in the same register and get the same attention.
-
Decide. Act, watch or accept.
Add a control, pursue an opportunity, keep an eye on it, or accept it as it stands. The reasoning is kept, so decisions can be revisited.