- Identify risks during service reviews, assessments, or incidents.
- Score risks using likelihood and impact.
- Assign an owner and treatment plan.
- Track and review on a quarterly cadence.
- Likelihood: 1 (rare) to 5 (frequent)
- Impact: 1 (low) to 5 (severe)
- Score: Likelihood × Impact
- Mitigate (reduce likelihood/impact)
- Transfer (e.g., insurance)
- Accept (risk acceptance with sign-off)
- Avoid (change approach)
- Monthly service review: top 5 risks
- Quarterly risk review: full register
- Annual audit readiness: evidence validation
- Audit readiness:
10-audit-readiness.md - Exception handling:
13-exception-handling.md - Threat model:
23-threat-model.md