Risk evaluation considers whether a situation needs attention in relation to relevant criteria and evidence. Risk treatment concerns the response selected and implemented. The decisions connect, but choosing an action before understanding the issue can produce activity that does not address the actual uncertainty.
The risk-based thinking guide explains the wider sequence. The terminology here supports practical reasoning; the organisation should use clear definitions appropriate to its method and applicable requirements.
Understand the situation before evaluating it
Identify the intended result, event or condition, possible effect and current controls. Preserve important assumptions and evidence limitations. A broad label such as supplier risk provides little basis for a proportionate decision.
Consider whether the evidence describes current operation, a proposed future arrangement or another period. An assessment can become misleading if those conditions are combined without explanation.
Do not assume that the existence of a procedure proves the control works. Evaluate relevant operation and exceptions where the decision depends on that assumption.
Evaluate against suitable criteria
Consider consequence, likelihood or other relevant factors using a method fitted to the decision. Criteria should make the basis understandable rather than rely on unexplained colours.
Applicable obligations remain important. An internal low rating cannot authorise non-fulfilment of a customer, legal or other requirement. Identify which decisions the organisation can actually make.
The risk matrix article explains how a structured method can help discussion while retaining limitations. A score is information for the decision, not the entire judgement.
Identify the response question
If action is needed, ask how the proposed response addresses the event, cause or consequence. A training session may be suitable for a capability gap while doing little about an uncontrolled system bypass.
Consider practical options and relevant trade-offs. Changing an activity, strengthening a control, altering a dependency or making another authorised decision can have different effects on the intended result.
| Decision stage | Main question |
|---|---|
| Understanding | What uncertainty and effect are being considered? |
| Evaluation | How significant is the situation against relevant criteria? |
| Response selection | Which action is justified and feasible? |
| Implementation | Has the chosen change entered actual work? |
| Review | Does relevant later evidence support the decision? |
This framework is an implementation aid, not a mandatory ISO worksheet.
Assign authority and resources
The person maintaining an assessment may not have authority to approve the response or accept a remaining uncertainty. Make those roles clear where the consequence warrants it.
If the issue crosses functions, provide coordination and escalation. Separate local tasks can be completed while the shared failure condition remains unresolved.
Identify the information, resources and capability needed to implement the action. A response recorded as agreed may remain only an intention if those dependencies are absent.
Distinguish expected and demonstrated effects
A proposed control can be expected to improve the situation, but the expectation needs testing. Do not lower a rating solely because an action is listed or a due date assigned.
Implementation evidence can show that a workflow changed or equipment was installed. Effectiveness evidence examines whether the response addresses the relevant condition under actual use.
Define what later information would support the conclusion and when a meaningful opportunity for evaluation will occur. Preserve uncertainty where that opportunity has not yet arisen.
Review side effects and remaining exposure
A response can affect connected work. An additional approval may reduce one failure route while creating delay or encouraging a new bypass. Consider the overall result rather than only the intended local benefit.
The mitigation strategies article discusses how responses can influence likelihood or consequence. Not every treatment is simply another inspection or reminder.
Identify what remains after the action and who can decide whether further work is needed. A closed action does not automatically mean every relevant uncertainty disappeared.
Keep the decision traceable
Retain enough information to connect evaluation, selected action, implementation and review. A register can reference detailed records rather than duplicate them in several inconsistent places.
Review when conditions or requirements change. A previously reasonable response may no longer fit the current process, even if its original action record remains complete.
The distinction between evaluation and treatment helps prevent premature solutions and unsupported closure. It connects a justified assessment with accountable action and later evidence, preserving the reasoning that makes the response appropriate to the actual situation.
A decision to seek more information can be appropriate when uncertainty prevents a defensible response choice. Identify the missing evidence, responsible person and consequence of waiting. This keeps further enquiry accountable rather than using assessment uncertainty as a reason to leave the issue indefinitely unresolved.
Document why a proposed response was rejected when that choice could later be questioned. A stronger inspection may have required unavailable expertise, or a transfer arrangement may have introduced unacceptable dependency. Retaining the reason avoids repeating the same argument at each review. It also makes it easier to reconsider the option when capability, cost or the operating context changes.