Governance and Risk

Apply the selected organizational policy with honest evidence. Formal decision analysis is useful for consequential uncertain choices, not every implementation detail.

Workflow

1. Establish scope, decision authority, governing policy/version and relevant evidence. Respect actual authorization; ask only when the decision exceeds it or materially missing information blocks action.
2. Identify feasible alternatives and criteria before scoring. State assumptions, dependencies, reversibility and consequences; avoid false precision from arbitrary weights.
3. Record risks as cause/event/consequence with exposure evidence, owner, mitigation, trigger and residual uncertainty. Link realized risks to issues.
4. Track configuration/change custody where needed: authoritative source, baseline identity, allowed change path, review/check evidence and rollback constraints.
5. Require appropriate verification and acceptance ownership. A review may be clean; defects/waivers need disposition, owner and evidence for closure or reactivation.
6. Revisit decisions and risks when triggers occur; retain the rationale, not ritual approval loops.

Evidence

A decision record names options, criteria/evidence, choice, rationale, owner and revisit trigger. A risk/waiver record names impact, action, authority, status and expiry/reactivation when applicable. Report uncovered policy obligations; do not claim a standard demands local quotas without an authoritative edition/source.

Optional references