Separate the Risk, the Control and the Evidence

Begin with an objective

A useful risk discussion starts with what the organisation is trying to achieve. APM describes risk in relation to the potential effect of a situation or event on an objective. State the objective before naming an uncertain event.

For a fictional training service, an objective is to send appointment details to the correct applicant in time for the session. A possible threat is that outdated contact details cause the message to reach the wrong person or fail to arrive. This is an example for learning, not an assessment of a real service.

Describe the intended safeguard

In this exercise, a control means a specified action or arrangement intended to help manage the risk. Record what it does, who carries it out and when it operates. Avoid using the word control as though naming it proves it works.

The fictional service might confirm contact details before sending appointment information. Describe the confirmation step and the responsible role. Do not invent an organisational rule or a universal review frequency.

Look for an observable record

Evidence helps the reviewer understand what actually occurred. A written procedure may show the intended design. A dated record or authorised observation may help show whether the step operated in the period reviewed. Keep those questions separate.

If the procedure requires a check, a copy of the procedure alone does not show that every check happened. Identify which records would support the review and which information is unavailable. Use the appropriate permission before looking at personal or restricted records.

Check the limits of the conclusion

A small sample can support a limited observation without proving that the whole process always works. Record the period, selection method and exceptions. Distinguish a missing record from proof that an action did not occur.

For the fictional service, two sampled bookings may contain confirmation records and one may not. The next step is to investigate the missing record and understand its meaning. Do not report universal effectiveness from those three examples.

Choose a proportionate next action

Agree whether the review needs more information, a correction or escalation through the established route. Record the owner and review date. The person performing a check should not silently take over a decision outside their authority.

Practice task: write one objective, one risk, one safeguard and one evidence question. Use the control-review checklist to test whether these statements are precise enough for another person to understand.

Source and practice note

APM risk terminology informs the objective-and-event distinction. The control and evidence exercise is an original RDE learning aid. This original RDE exercise uses fictional examples. Adapt it to your organisation, authority and specialist advice.

APM risk terminology

Cover image: AI-generated illustrative scene created specifically for this resource.