risk-statements

A risk statement connects an uncertain event to its cause and consequence in relation to an objective: what could happen, why it could happen, and why it matters. Write or review its title and description, returning wording to the auditor or calling skill.

Starting pattern and completeness

The title is a short noun phrase naming the uncertain event. It is unique within the activity and matches the description's boundaries. Include the affected process, system, or population when needed to distinguish otherwise identical risk titles.

A useful starting point for the description is:

[Event] may occur due to [causes], resulting in [consequences].

Adapt the wording to the context. Write one paragraph, roughly one to two sentences, describing what could happen and why it matters. A description is complete when a reader can point to:

• Event: the uncertain thing that could happen.
• Cause: the specific condition that could give rise to it.
• Consequence: the plausible effect that shows how the objective is affected.
• Objective: what is at stake, named in the statement or its context.

Include relevant records, outputs, systems, or activities where they clarify how the risk could arise or affect the organization’s objectives.

Sources and gaps

Base descriptions on supported facts and plausible causal relationships. Distinguish existing conditions and past incidents from uncertain events and potential consequences. Preserve differences between sources with their attribution.

Mark missing facts with descriptive bracketed gaps. When revising supplied wording, retain its source references, visible information gaps, and basis labels. When drafting directly for the user, identify the material or attributed statements used. When another skill requests the wording, return this supporting information with the draft for inclusion in its workpaper.

Risk boundaries

Describe one coherent event chain per statement, with a clear connection to the objective. Keep related causes and consequences together when they explain the same risk. Different causes, consequences, or affected processes alone do not establish separate risks. When wording combines distinct event chains that would be understood, assessed, or managed differently, explain the distinction and propose separate statements.

When reviewing multiple statements, compare their event chains and scope for duplicated coverage. Clarify shared causes and consequences and recommend combining statements that describe the same risk.

Faults

When reviewing risk statements, check for the following problems and apply the corresponding guidance.

• A title that does not identify the risk being described. Name the uncertain event and match the description's boundaries. A topic, cause, or generic consequence alone is insufficient.
• An incomplete risk description. Describe the uncertain event, the conditions that could give rise to it, and the consequences that could affect the objective.
• An existing issue without explaining the remaining risk. Describe how the issue could lead to further events or consequences that affect the objective.
• Distinct risks combined, or one risk split across descriptions. Keep related causes and consequences of one event chain together and propose separate statements for distinct chains. Recommend combining statements that describe the same risk.
• A cause too vague to explain the event. Replace generic labels with the specific condition the available information supports, marking a gap when it supports none.
• A consequence too vague or disconnected from the objective. State the plausible effect that shows why the event matters and how the objective is affected, preferring specifics over generic phrases where supported.
• A missing or unclear objective. Identify what is at stake in the statement or its context, using the supplied objective or marking a gap when it is not established.
• An unclear or circular explanation of the risk. Explain how the stated causes could lead to the event and how the consequences could follow, with each element adding information rather than restating another.
• An overloaded statement. Include the causes and consequences needed to understand the material risk; split or move supporting detail to context when it obscures the core.
• Invented or guessed facts. Use details supported by the supplied material or information provided by the user or other identified sources. Mark missing information with descriptive bracketed gaps and distinguish potential events and consequences from established facts.
• An embedded risk rating, control assessment, or proposed response. Describe the event chain and keep ratings, judgments about controls, and responses separate from the risk description.

Output

Check that the statements adhere to the guidance above before returning them.

Return the drafted or revised titles and descriptions to the user or calling skill, with a brief summary of what was created or changed.

Distinguish changes made from proposed changes, including any recommendations to combine, separate, or remove statements.

For each unresolved question or information gap, state which statement it affects and what clarification or source material is needed to resolve it.

If no changes are needed, confirm that the statements meet the guidance.