Unchallenged assumptions turn risk ratings into confident looking guesses. Learn to expose uncertainty, test scenarios and revisit ISO management decisions.
An organization may describe a risk as low because an experienced supervisor says the problem has never happened. Another team may rank every theoretical threat as critical because nobody wants to defend a lower score. In both cases, implicit assumptions, not observed evidence, drive the outcome. A useful risk based gap assessment makes assumptions explicit, distinguishes probability from consequence and designs targeted tests before committing scarce improvement resources.
01Q1. Expose the unstated premises in the risk register
Risk entries often conceal premises: The contractor always follows the permit, the backup works, the regulator accepts an interpretation, or demand remains stable. A probability score can imply evidence that has never been collected. The first task is to make the judgement reproducible.
For each high materiality decision state the scenario, assumed operating conditions, source of estimates and what observation would invalidate the assumption. Ask independent process owners to challenge it before approval.
Decision test: Ask what record would contradict this statement.
02Q2. Do not replace absence of incidents with proof of safety
A rare but severe event may not appear in recent historical records. Conversely, frequent minor complaints do not necessarily imply catastrophic outcomes. Availability of incident data is one input among several, and underreporting or changed operations may undermine its meaning.
Review leading indicators, control tests, near misses and credible failure mechanisms. Describe uncertainty instead of assigning low likelihood solely because no event is visible in the selected period.
03Q3. Separate baseline exposure from the assumed control response
A management team may credit an emergency plan, supplier certification or user access list as though each always works. The relevant question is whether the protection activates when required and produces the intended result.
Test a sample of actual or simulated control responses, including escalation and recovery. Use the observed strength and limitations of the barrier when discussing residual exposure, not its written existence.
04Q4. Challenge aggregation that hides local extremes
An average across sites, products or shifts can conceal a single location with severe exposure. A combined score may be dominated by routine low consequence events while a rare hazardous task remains inadequately controlled.
Segment scenarios by credible operating variation and consequence. Escalate any high impact outlier for explicit management attention even when the overall programme score looks comfortable.
Operating test: Check the latest routine case and one abnormal event.
Decision Matrix: Evidence and Consequence
Use this comparative matrix as an editorial decision aid, not an automatic severity rule. Select and adapt the criteria for the organization’s real processes and obligations.
| Hidden assumption | Exposure if wrong | Challenge test |
|---|---|---|
| Last year is representative | New operations unprotected | Compare recent changes and loads |
| Procedure always followed | Control absent at exception | Observe abnormal transaction |
| One site mirrors all | Local hazards missed | Sample contrasting locations |
| Backups recover quickly | Unacceptable outage | Timed restoration exercise |
05Q5. Recognize incentives and anchoring in workshops
The first number voiced by a senior manager can become the default for the room. Project owners may underestimate risk to protect a milestone, or overestimate it to secure resources. Structured challenge is especially important when the people who approve the work also propose the rating.
Collect initial judgements independently, show the evidence behind differences, then agree on documented assumptions and decision boundaries. Invite technical and frontline voices capable of contradicting management assumptions.
06Q6. Use scenario testing instead of endless debate
Arguments about whether a risk is “medium” or “high” can persist without new evidence. A concrete scenario often resolves the uncertainty: A failed machine guard, rejected batch, delayed legal filing or compromised release. The useful output is the decision required if that event occurs.
Run a tabletop walkthrough or inspect a recent adverse event. Record what the control would detect, who could act, time to response and possible residual impact. Update assumptions after the result.
07Q7. Reopen decisions when context changes
Supplier substitutions, new laws, automation, reorganizations and additional sites can invalidate earlier risk judgements. A once defensible rating does not stay defensible merely because the register has an annual review field.
Set change triggers tied to material operations, incidents and performance deterioration. Retest the most consequential assumptions after change and document any decision not to modify the control.
Closure check: Confirm the result in subsequent normal work.
Practical Decision Method: Applying the Assessment
Build an assumptions register for consequential choices
Capture the decision being made, its assumptions, supporting evidence, confidence level and owner. Examples include expected supplier lead time, equipment redundancy, recovery capability, employee competence or the authority of a contractor. Flag assumptions whose failure would materially change a control or regulatory response. A structured register is useful only if tied to triggers and later evidence, not when it becomes another static document reviewed without challenge.
Test counterfactuals rather than only the preferred story
Ask what would need to be true for the assessment to be wrong. If managers believe a backup protects customer delivery, imagine the primary system failing while the backup has a stale data set or expired account. If a machine safety control relies on a supervisor, ask what happens on a weekend shift. This does not mean pessimistically scoring everything high; it reveals which premises are operationally important and which inexpensive test can resolve uncertainty.
Communicate uncertainty honestly to decision makers
Instead of reporting a single precise residual risk number, describe the range of credible outcomes and the quality of information. Distinguish evidence based judgements from expert assumptions and state which decision can be made now versus after another control test. Define an explicit review trigger so changing technology, processes or contractual obligations automatically reopens the assessment. Better risk governance is not perfect prediction; it is transparent revision when meaningful evidence arrives.
A structured challenge session
Invite the people responsible for the control, those affected by its failure and a technically credible challenger. Present the scenario and evidence without the proposed score. Ask participants to identify the weakest premise and its consequence if false. Seek a specific test: A recovery drill, unauthorized access attempt, supplier deviation or representative transaction. Determine who will run it, when results will be reviewed and which interim control remains in place.
The output should not be a compromise number accepted to end the meeting. It should be a traceable judgement, explicitly describing what is observed, what is assumed and which uncertainty matters. If new evidence contradicts the assumption, update the risk decision and management action promptly. An adaptable process is more reliable than the appearance of precision.
Illustrative Case: From Observation to Decision
Illustrative scenario: A service provider treated a failover process as low risk because its disaster recovery plan had been signed. A targeted exercise found that the recovery account no longer held sufficient access rights after an IT reorganization. Rather than arguing about the risk matrix score, managers corrected the permission dependency, reran the exercise and revised the testing trigger for future structural changes.
Improve the decision before polishing the score
An assumption becomes dangerous when it is treated as a verified fact simply because a senior person approved a risk register. The practical remedy is to record premises, challenge the relevant failure scenario and gather evidence that can disconfirm the preferred view.
For consequential exposures, authorize focused tests and define what changes in the decision if they fail. Reopen ratings after material process change and retain the reasoning behind revisions. The goal is not to predict every event, but to ensure that the organization can correct its risk judgement when new facts make yesterday’s confidence untenable.
Related implementation resources
Editable tools for organizing controls, evidence, findings and improvement actions relevant to this assessment topic.