Risk Management Does Not End With the Risk Assessment

Risk registers are comfortable artefacts. They are structured, they are reviewed, they demonstrate diligence. They are also, in many organisations, the place where risk goes to be documented rather than managed.

The assessment is not the work. The decision is.

Risk lives at the decision point

A risk assessment produces a number and a narrative. Neither changes an outcome. What changes an outcome is a decision made by a person with limited time, incomplete information and a schedule — a crew deciding whether to continue, a duty manager deciding whether to accept a delay, a training manager deciding whether to keep an instructor on a programme.

If the assessment does not reach that person, in a form they can use at the moment of decision, it has no operational value.

Three failure modes

The assessment is written by people who do not make the decision. A safety department produces a matrix; the flight deck receives a paragraph. The translation is where the meaning is lost.

The assessment is done once. A route is assessed when it opens and not reviewed when the operator changes, the airfield changes, or the season changes. The document remains valid while the risk does not.

The threshold is written after the event. Criteria are adjusted to fit what happened, not what should happen. This is how an organisation learns the wrong lesson and calls it a review.

A risk assessment that does not change a decision is a filing exercise with a score attached.

Making risk operational

Several practices tend to separate organisations that manage risk from organisations that document it:

• Write the decision rule, not only the risk rating. "If the crosswind is above X at the destination, we divert to Y" is usable at the gate. "Medium risk, mitigated to low" is not.
• Give the decision to the person closest to the information. Support them with clear criteria, then let the criteria do the work.
• Review at the frequency of change. New aircraft, new crew, new route, new season — each is a trigger for review, not an annual calendar entry.
• Track the decisions, not only the incidents. The value of a risk process is visible in the choices it changed.

The uncomfortable question

At the end of a risk review, ask one question: what will we do differently next month? If the answer is a document, the process has not finished.

Risk management is a decision discipline. Everything else — the register, the matrix, the committee — exists to support it.