To the Bedrock
Products Over Projects

Residual Risk Assessment

Score the remaining uncertainty after current evidence, controls, and governance are considered. The result is not a certification. It is a structured conversation aid for identifying whether learning, coordination, or formal control should dominate the next management response.

Assessment Instrument

Use 0 · None when the residual uncertainty is negligible or credibly controlled. Use 3 · High when the uncertainty remains consequential and weakly evidenced. When unsure, score the uncertainty rather than the confidence of the loudest stakeholder.

Score residual uncertainty after current evidence and controls. Leave blank if not applicable.

Product uncertainty

Value/desirability risk

It remains uncertain whether users, customers, or beneficiaries will choose or value the proposed change.

Usability/adoption risk

It remains uncertain whether people can use the change successfully in their actual operating context.

Feasibility risk

It remains uncertain whether the solution can be built, integrated, operated, and maintained within acceptable and reasonably predictable cost constraints.

Business viability risk

It remains uncertain whether the change fits financial, legal, commercial, support, or operating constraints.

Outcome risk

It remains uncertain whether the intended performance, behavioural, or business outcome will improve.

Execution uncertainty

Coordination/dependency risk

Completion depends on many teams, vendors, approvals, systems, or external decisions aligning.

Completion risk

The known work may fail to meet time, cost, scope, quality, or resource constraints.

Migration/cutover risk

The transition from current to future state may create disruption, data loss, outage, or rework.

Correctness/compliance risk

The implementation must satisfy demanding correctness, auditability, legal, regulatory, or contractual criteria.

Operational readiness risk

The organisation may be unable to run, monitor, support, train for, or govern the change after launch.

Hazard and control exposure

Harm exposure

Failure could harm customers, patients, workers, the public, the environment, data subjects, or critical operations.

Control evidence risk

Controls must be designed, tested, documented, authorized, and monitored to satisfy assurance obligations.

Residual acceptance risk

It is unclear who has authority to accept the remaining risk or what evidence is sufficient.

Result

Dominant residual risk

Score the items above

The governance recommendation will appear as you complete the assessment.

Product —
Execution —
Control —

Interpret the result as a governance prompt. A high product score does not remove the need for planning; it means planning should not be the primary mechanism for reducing the largest remaining uncertainty. A high control score does not remove the need for learning; it means learning must occur inside explicit risk appetite, controls, evidence, authorization, and monitoring.