Controls, signposts, and actions
Controls and treatments
- Existing control is already operating.
- Shaping action tries to make an assumption more likely to hold.
- Hedging action preserves options if it fails.
- Mitigation reduces likelihood or impact.
- Contingency prepares a response after a trigger.
- Opportunity enhancement increases the chance or value of a favorable event.
Every action needs a linked risk or assumption, owner, due date, status, expected effectiveness, and verification. Mark an ineffective control explicitly rather than quietly leaving it active.
Signposts
A complete signpost has an observable indicator, condition or direction, threshold, data source, cadence, owner, current observation, status, and predefined response. āMonitor closelyā is incomplete.
When a signpost is triggered, activate or escalate the named response, record the observation, and revisit the linked ratings and assumptions. Do not close the risk automatically.