Key takeaways
- A mitigation measure does not necessarily eliminate risk.
- Acceptance of remaining risk is a governance decision.
- Monitoring continues throughout transformation.
Risk concerns outcomes
Risk is associated with uncertainty that may affect an objective. Its effect may be unfavorable or favorable; analysis should identify consequences that matter to the enterprise. Technical, human, operational, and external risks can combine during transformation. Inadequate training can make a technically compliant solution unusable in practice.
The approach includes six activities: classification, identification, initial risk assessment, mitigation, residual risk assessment, and monitoring. Assessment helps consider likelihood and impact and prioritize responses. Classification should support decisions rather than create artificial precision: estimates should identify assumptions and information that is still missing.
Govern the remaining risk
Initial risk is assessed before mitigation measures. Residual risk remains after those measures. It is not automatically zero, and acceptance belongs to the appropriate authority. Monitoring checks that actions were completed and that exposure remains acceptable as the context changes.
- Assign owners for actions and monitoring.
- Connect risks to roadmap and migration decisions.
- Reassess after new evidence or a significant change.
TERMS TO KNOW
The terms, in context.
- Initial risk
- Risk assessed before applying mitigation measures.
- Residual risk
- Risk remaining after those measures have been applied.