C2.2 Validated risk statement

Risk management handbook [11]; practitioner standard's nine-field description [6]

What it requires. Every risk is written in four parts: given a condition that exists today, there is a possibility of a departure from what was planned, affecting a named asset, with a consequence stated against an objective. A statement missing any part is rejected, and so is one with its own solution embedded, because that pre-empts the response. The statement is the text of the register row; headings and nouns are not statements. Beneath it the fuller description carries the nine fields of the practitioner standard, including scope, stakeholders and the controls that already exist.

Where it comes from. The space agency's handbook [11] defines risk as the potential for a shortfall against a performance requirement and insists on the mold: condition, departure, asset, consequence, nothing else. It distinguishes a risk from an issue, a risk that has already happened, and from a concern, a candidate not yet validated. The practitioner standard [6] supplies the nine-field description behind the statement, from name and scope through quantification and tolerance to the controls in place.

What it reconciles. This component gives the framework a test for whether a row is a risk at all, the test chapter 12 described arriving in finance from aerospace. It also settles the relation between its two sources: the four-part statement is the short form, mandatory and testable; the nine fields are the long form. A register with one and not the other has either a slogan or an essay. The rule against embedding the solution protects C4.1, where a named person chooses among seven responses: “risk that we do not buy the second generator” has already chosen.