If risks sit "in treatment" for years, then how do we get them moving?

Start

Risks have sat 'in treatment' for years

'In treatment' often hides three different problems: no real action, actions that keep slipping, or actions done that never moved the score. A risk outside appetite also stays counted as outside appetite until its residual score actually falls. Years in treatment usually means nobody has been asked for a decision.

• Then: List each stuck risk with its position and linked actions

Step

List each stuck risk with its position and linked actions

Work from your register and treatment plan, one risk at a time. For each, note its residual band and position against appetite, the actions linked to it, and each action's owner, due date, status and cost. Risks outside appetite come first.

• Then: Where does the risk sit against appetite?

Decision

Where does the risk sit against appetite?

The position decides how hard to push. Within appetite, no treatment decision is owed. Outside appetite, a decision was owed within the window. Outside tolerance, the decision was never the owner's alone. If the rating is stale or unknown, reassess it first and take the stricter position until you have.

• Within appetite: Within appetite: no decision is owed; review it quarterly
• Outside appetite, within tolerance: Does it have actions with owner, due date, cost and expected score?
• Outside tolerance, or not known: Outside tolerance: put it to the top of the organisation now

Outcome

Within appetite: no decision is owed; review it quarterly

A risk within appetite needs no new decision. The owner reviews it every quarter and may still reduce it where that is cheap. If a reduction is wanted, give it a dated action; otherwise leave it to the quarterly review. Put the effort into the risks outside appetite.

Outcome

Outside tolerance: put it to the top of the organisation now

Only the top of the organisation decides here: the board, or a board risk committee it has delegated to; in a two-tier structure, the management board; with no board, executive management. The chair hears out of cycle. The options are to fund or order treatment, accept the risk explicitly and record why, or change the appetite. A plan that has run for years is itself the reason to ask.

Decision

Does it have actions with owner, due date, cost and expected score?

A treatment decision to reduce, avoid or transfer is recorded as actions, each with one owner, a due date, a cost and the residual score expected when it is done. A risk marked 'reduce' with no such action has a label, not a plan. If you cannot find the actions, answer no.

• No, or not known: No real decision: escalate to executive management
• Yes: What is holding the actions up?

Outcome

No real decision: escalate to executive management

The pack's window for a treatment decision is 30 calendar days from the risk first being assessed outside appetite, and later reviews do not restart it. When it has passed, the head of information security escalates to executive management. A risk kept outside appetite for more than a quarter without a decision is reported by name. Ask the owner to reduce, avoid, transfer or accept.

• Then: Has the same category been outside appetite two quarters running?

Decision

What is holding the actions up?

Read each open action's status and due date. Awaiting approval means the work cannot start until someone funds it. Overdue is calculated from the due date, never typed. At risk means not yet overdue but likely to miss. Done means the work is finished, whatever the score says.

• Waiting for money: Put the funding to its approver as a decision, with options
• Late, or likely to be: Is an action already past its due date?
• Done, but the score has not fallen: Reassess the risk on evidence that the controls work
• Nothing: it is on time: On track: report the plan and date each quarter

Outcome

Put the funding to its approver as a decision, with options

Take the ask to whoever can approve spending at that level. State it as a decision: the action, its cost, when it is done, the position it brings the risk to, and the options. The pack's worked example offers approve now, approve in part, or do not approve and accept the risk. If the money is refused, the risk does not stay in treatment: accept what remains at the right level, or choose another treatment.

• Then: Has the same category been outside appetite two quarters running?

Decision

Is an action already past its due date?

Overdue is calculated from the due date, never typed, and every overdue action counts in the quarterly measure. Moving a due date hides it. The pack sets no rule for re-dating an action, so if you allow it, make the new date a decision someone records. If you cannot tell from the record, answer yes.

• Yes, or not known: Past due: count it, and escalate once 30 days late
• No: Mark it at risk and name it in the quarterly report

Outcome

Past due: count it, and escalate once 30 days late

Every overdue action is counted in the quarterly report. The pack's target is none more than 30 days overdue: past that, escalate it to the risk owner and executive management and name it with its owner. Overdue actions keep a risk outside appetite longer than the plan said. The escalation names the risk, its band and position, the date missed and the decision needed.

• Then: Has the same category been outside appetite two quarters running?

Outcome

Mark it at risk and name it in the quarterly report

An action that will miss its date is shown before it does. Name the cause as the pack's example does: an action at risk because the team lost two engineers, with the dependency that would fix it. That gives executive management the chance to act before the date passes.

Step

Reassess the risk on evidence that the controls work

When an action is done, reassess the risk and check the residual reached what was expected. A control lowers the score only with evidence that it works. In the pack's ransomware example, the network separation counted only after a test showed the warehouse systems could not be reached.

• Then: Is the risk still outside appetite after reassessment?

Decision

Is the risk still outside appetite after reassessment?

Compare the new residual band with the category's appetite. If the actions did not touch the weakness in the scenario, the score may not move at all. If the evidence is not in yet, answer yes.

• Yes, or not known: Add actions, or accept what remains at the right level
• No: Record it back within appetite and report the movement

Outcome

Add actions, or accept what remains at the right level

Either plan further actions aimed at the weakness in the scenario, or accept the remaining risk on your acceptance form, signed at the level its band and position require. Do not leave it marked as in treatment with nothing open.

Outcome

Record it back within appetite and report the movement

Update the register with the new score and position. Report the movement to executive management as the pack does: risks outside appetite fell from three to two after the warehouse network was separated. Keep the done action in the plan as the record.

Outcome

On track: report the plan and date each quarter

Executive management sees treatment progress every quarter. Outside appetite, their part is to note the plan and date, or challenge them, and decide if the plan needs money or a change of priority.

Decision

Has the same category been outside appetite two quarters running?

One slipping action is a project problem. A category that stays outside appetite quarter after quarter is a signal that the plan, the funding or the appetite itself needs a decision. In the pack's defaults, two quarters in a row is the point to review the appetite statement. If you have not kept past reports, answer yes.

• Yes, or not known: Put the plan or the appetite to the board as a decision
• No: Check it again at the owner's next quarterly review

Outcome

Put the plan or the appetite to the board as a decision

Changing a category's appetite is a board decision, made openly with its reason, never a silent edit to the register. The alternative is to fund or reprioritise the plan. Who decides depends on how you are governed: the board or its delegated risk committee, the management board in a two-tier structure, or executive management where there is no board.

Outcome

Check it again at the owner's next quarterly review

Owners review every risk every quarter, and the actions' progress is part of that review. If the same action is still stuck then, run it through this flow again.