Risk Experts / Using it

After an event, separate the decision from the outcome

A good decision can produce a bad result.

Reviews after an incident are conducted knowing what happened, and hindsight makes the missed signal obvious and the chosen path look negligent. Judging the decision by the outcome is the standard error and it produces two bad effects: unfair findings, and a lesson that discourages anybody from making a judgement call again.

The corrective is procedural. Record what was known at the time, separately from what is known now, and assess whether the decision was reasonable on the first. A decision that was sound and turned out badly is not a failure of risk management; it is what taking a risk means.

This matters for the register too. An event that materialises from a consciously accepted risk is evidence that the process worked, not that it failed, provided the acceptance was recorded and the assumptions held. That distinction is only available if the acceptance was written down at the time.

Where the review does find fault, it is worth asking why the system depended on that judgement being correct. Sometimes it legitimately did. Often the question surfaces a single point of failure that nobody had noticed until it failed.

The other discipline after an event is to check whether it was on the register at all, and to record the answer honestly. An organisation that finds its incidents were consistently unlisted has learned something important about its identification process that no amount of reviewing existing entries would have revealed.