21 After the assessment

Completing a detailed risk assessment is a significant piece of work and, as I said at the beginning of the book, many more risk assessment are started than are completed. So you should take away a great deal of satisfaction and a real sense of accomplishment that you’ve closed out your assessment.

Unfortunately, as Bobbie’s about to find out, finishing the assessment isn’t the end of the process. Keep in mind that the risk assessment is designed to help the organization understand its risk so it can make risk-based decisions. That decision-making is what’s going to happen next. Your part in that will differ depending on the organization and your role but delivering the assessment report probably isn’t the end of your involvement.

What follows is an overview of one of the more likely steps: addressing your risks. That is, determining what to do about the risks you’ve identified and putting these decisions into a risk management plan. Addressing your risks is as big a topic as conducting the risk assessment so this is simply a taster for what might come next but it should help prepare you to take part in the next stage of this journey.