Define risk categories that match decisions
Risk categories should help reviewers decide what needs approval, mitigation, evidence, or escalation.
- Use commercial, legal, compliance, operational, data, renewal, supplier, or payment risk categories.
- Capture likelihood, impact, severity, and whether work can continue while open.
- Assign risk owner, mitigation plan, due date, and verification evidence.
- Record policy exception, approval requirement, or escalation path.






