Part II · Chapter 3 · Risk, without the score · lesson 6
Put the name on it, and then go and tell them
12 min
Builds on Four things you can do, and only one of them is work
Part II · Chapter 3 · Risk, without the score · lesson 6
12 min
Builds on Four things you can do, and only one of them is work
The register below will not save an accepted risk without a name. Choose accept and a field appears in the same place, in the same second, and the button stays dead until you put somebody in it.
That is the entire enforcement, and it is deliberately weak. The field cannot tell a real name from a plausible one. It cannot tell whether the person has heard of the row, whether they could do anything about it, or whether they would still say yes if you asked them in front of their own team. All it checks is that the cell is not empty, which is the only thing a form can honestly check.
So the field is not the lesson. The lesson is the three tests you run on the name yourself, before you type it.
Would they recognise the sentence? Not the category — the row, as worded. If you would have to explain the risk before they could agree to it, they have not agreed to it yet.
Could they do something else? Fund the fix, overrule it, or stop the activity. Somebody with none of those three options is not accepting a risk; they are being informed about one, which is a different and much weaker act.
Will anybody tell them when it happens? An acceptance is a bet. A person who will not hear the result is not carrying it.
The second test eliminates most names. It is also the one that explains why so many registers name the security lead for everything: that person knows about every row and can change almost none of them.
Go through your risks below. Set accept where accept is honest, and put in the name the three tests survive.
Then the part that is not in the software. Take the row to the person, as a sentence, and watch what happens. One of three things will.
They say yes, that is mine. The register was right and now it is also confirmed, which is worth more than the field is.
They say yes but, and the but is a condition — until the migration ships, as long as we are told within a day, provided it stays under this volume. That condition is the most valuable thing in your whole register and there is nowhere in this register to put it. Write it in your own notes beside the row.
Or they say no, I am not carrying that. Which is not a failure of the exercise; it is the exercise working. The risk was never accepted, you have found out now rather than after an incident, and the row goes back to being undecided.
Your own register
Nothing here is graded, and nothing here leaves your browser unless you are signed in. A filled-in register is an inventory of your known weaknesses, so keep the real one where your auditor can see it — this is somewhere to think.
What could go wrong
A sentence with a victim in it, not a category. There is no score field here and there is nowhere to put one: the two bands are never multiplied.
Once a year or so
A customer notices
What will you do about it?
What does not line up
Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.
These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.
Sooner or later somebody suggests that the Security Working Group accepted it, or the risk committee, or the leadership team. This is not laziness. It is usually the organisation's genuine governance, and the group genuinely met.
The trouble is in what a group can and cannot do. A group can approve. Only a person can carry. Nobody in a committee has ever been telephoned at three in the morning, and when the thing happens, the sentence the committee accepted this in March describes a decision with no inside.
The honest form keeps both. Name the person who carries it — usually the one whose budget or product the risk lives in — and record the committee as the forum where it was agreed. One name, one date, one place it was discussed. A committee in the name field on its own is accountability distributed until it is absent, and it is absent in the one week you need it.
Check
Every register tool has an owner column, and most of them have it on a different screen from the treatment. The acceptance happens in a conversation, the treatment gets set that afternoon, and the name is a separate trip that somebody will make later.
Nobody makes the trip. Not because they are careless — because by the time they would, the sentence they were going to write has gone, and entering a name without the sentence feels like making something up, which it is.
The fix is not a reminder. It is putting the field where the decision is, so the name is typed while the conversation is still in the room. That is the only change in this whole block that is load-bearing, and it is the reason this register asks the question at the moment you pick the treatment.