Part II · Chapter 3 · Risk, without the score · lesson 4
Four things you can do, and only one of them is work
13 min
Part II · Chapter 3 · Risk, without the score · lesson 4
13 min
There are four things you can do with a risk and there have only ever been four. Reduce it. Accept it. Hand it to somebody else. Stop doing the thing that causes it.
Open almost any register and the treatment column reads mitigate on every row. Forty rows, forty mitigates, and no two of them mean the same thing — a few are controls that exist, a few are controls somebody is building, and most are controls nobody has started, filed under a word that makes the row look handled.
Before you fill your own column in, commit to what you expect to find.
Predict
Each of the four costs something different, and the cost is how you tell which one you are actually choosing.
Reduce costs hours, every period, forever. A control is not a purchase; it is a standing commitment with an owner who has other work.
Accept costs nothing today and needs a name on it. Somebody has to be willing to say out loud that this is a thing we are living with.
Hand it over costs a premium or a negotiation, and buys money rather than continuity. Your product is still down.
Stop doing it costs the activity. It is the only one of the four that removes the risk rather than managing it, and it is the one nobody offers.
A register with no accepts in it has not been filled in honestly. A register with nothing but accepts has not been read by anybody with a budget.
Go through your rows below and set a treatment on each one. Use accept where accept is what is happening, even where that feels like admitting something, because a row marked reduce with nobody reducing it is the same risk plus a false statement about your organisation.
Then the question the column cannot hold. For each row you marked reduce: who is doing the reducing, and do they know? For each row you marked accept: who carries it when it happens? That second answer is the whole of the next lesson, and the register will ask you for it by name the moment you pick accept.
Your own register
Nothing here is graded, and nothing here leaves your browser unless you are signed in. A filled-in register is an inventory of your known weaknesses, so keep the real one where your auditor can see it — this is somewhere to think.
What could go wrong
A sentence with a victim in it, not a category. There is no score field here and there is nowhere to put one: the two bands are never multiplied.
Once a year or so
A customer notices
What will you do about it?
What does not line up
Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.
These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.
This is the condition under which everything above stops holding.
The treatment column is filled in by whoever is keeping the register — often one person, often the person who was given the certification project, usually somebody with no authority over the activity that creates the risk. They pick reduce because reduce is the responsible-sounding word, and the hours it commits belong to a team that was not in the room.
The consequence lands somewhere else again. The finance lead carries the invoice risk. The on-call engineer carries the one about the staging database. Neither of them chose the treatment, and neither of them was asked whether the treatment was the one they wanted.
So read your own column back with one substitution. Instead of asking whether each treatment is right, ask who you would have to go and tell. Where the answer is nobody, because you are the one who would do it and the one who would carry it, the row is probably honest. Where the answer is a name, the row is a decision you have made on somebody else's behalf, and it is not yet a decision at all.