Risk management: from initial to residual

What is a risk?

TOGAF uses the ISO 31000 definition: risk is the effect of uncertainty on objectives. That effect means any departure from what is expected, favorable or unfavorable. Uncertainty arises because the future has to be anticipated with information that is never perfect; better-quality information should in principle lead to better decisions.

Every decision weighs opportunities and threats, the likelihood of favorable or harmful outcomes, and the size of each. Identifying and evaluating these factors is risk assessment, or risk analysis. Using them in decision-making is risk management, which seeks a balance between positive and negative outcomes.

The TOGAF process

Every transformation carries risk. Risks must be identified, classified, and mitigated before starting, so that they can be tracked throughout the effort. The process includes six activities, listed below.

• Risk classification
• Risk identification
• Initial risk assessment
• Risk mitigation
• Residual risk assessment
• Risk monitoring

Qualitative or quantitative approach

ADM Techniques describes a qualitative approach. For a rigorous quantitative approach, TOGAF points to the Open FAIR Body of Knowledge (Open Risk Taxonomy and Open Risk Analysis), while the Integrating Risk and Security Series Guide (G152) brings these notions into security architecture.

Two levels of risk

Initial risk is assessed before mitigating measures are defined and implemented; residual risk is assessed after they are implemented, if any. The gap between the two shows the expected effect of the chosen measures.

Mitigation is a continuous effort. Triggers often lie outside the planners’ reach, such as a merger or an acquisition, hence the need to keep watching the transformation context.

The role of governance

The architect can identify risks and mitigate some of them, but it is within the governance framework that risks are first accepted and then managed. In the ADM, they are spotted as early as Phase A, during the transformation readiness assessment, and monitored in Phase G, where the identification and mitigation worksheets are kept current as governance artifacts. An unmitigated critical risk may justify a new cycle, full or partial.