To the Bedrock
Products Over Projects

Residual Risk Assessment

Score the uncertainty that remains after current evidence, controls, and governance. Use the result to discuss whether learning, coordination, or formal control should guide the next management response. The assessment does not provide certification.

Assessment Instrument

Use 0 · None when the residual uncertainty is negligible or credibly controlled. Use 3 · High when the uncertainty remains consequential and weakly evidenced. When unsure, score the uncertainty rather than the confidence of the loudest stakeholder.

Score residual uncertainty after current evidence and controls. Leave blank if not applicable.

Product uncertainty

Value/desirability risk

It remains uncertain whether users, customers, or beneficiaries will choose or value the proposed change.

Usability/adoption risk

It remains uncertain whether people can use the change successfully in their actual operating context.

Feasibility risk

It remains uncertain whether the solution can be built, integrated, operated, and maintained within acceptable and reasonably predictable cost constraints.

Business viability risk

It remains uncertain whether the change fits financial, legal, commercial, support, or operating constraints.

Outcome risk

It remains uncertain whether the intended performance, behavioural, or business outcome will improve.

Execution uncertainty

Coordination/dependency risk

Completion depends on many teams, vendors, approvals, systems, or external decisions aligning.

Completion risk

The known work may fail to meet time, cost, scope, quality, or resource constraints.

Migration/cutover risk

The transition from current to future state may create disruption, data loss, outage, or rework.

Correctness/compliance risk

The implementation must satisfy demanding correctness, auditability, legal, regulatory, or contractual criteria.

Operational readiness risk

The organisation may be unable to run, monitor, support, train for, or govern the change after launch.

Hazard and control exposure

Harm exposure

Failure could harm customers, patients, workers, the public, the environment, data subjects, or critical operations.

Control evidence risk

Controls must be designed, tested, documented, authorized, and monitored to satisfy assurance obligations.

Residual acceptance risk

It is unclear who has authority to accept the remaining risk or what evidence is sufficient.

Result

Dominant residual risk

Score the items above

The governance recommendation will appear as you complete the assessment.

Product —
Execution —
Control —

A high product score calls for learning as the primary way to reduce the largest remaining uncertainty, alongside planning. A high control score requires learning within explicit risk appetite, controls, evidence, authorization, and monitoring. Use either result to guide the governance discussion.