The principles of Plain Risk guide how risks are described, assessed, and managed. Applying them requires a clear account of the situation and reasons for the judgements made.
Identify what is being assessed and for what purpose
- Identify the risk, control, or decision being assessed and the question being asked about it.
- State the point of reference for the assessment, such as an intended effect, objective, or limit. Where ratings are used, deciding which rating best fits is a separate judgement.
Describe what could happen and who or what could be harmed
- Describe the possible harm or loss and who or what is exposed to it.
- Explain the events, conditions, or changes that could lead to the harm and what could follow. Include further steps and branches where they matter to the account.
Use clear concepts and examine their relationships
- Make clear how causes, consequences, exposure, harm, and controls relate in the situation being described.
- Consider that the same action can prevent one harm and contribute to another. Its place in the account depends on the risk being described.
- Distinguish what a control is intended to bring about, what is expected to happen, and what actually happens.
Take circumstances and uncertainty into account
- Establish the circumstances relevant to the assessment, including the period and conditions to which it applies.
- Distinguish what is known, what is assumed, and what remains uncertain. Explain the grounds for judgements about likelihood and possible harm.
- Consider how a change in circumstances would affect the description, assessment, or response.
Assess how controls work
- Assess design by considering a control’s expected effects, and effectiveness by considering its actual effects. Relate each assessment to the intended effect, objective, and possible harm or loss.
- Trace any further responses and dependencies needed to achieve the objective. A control producing its immediate effect may still leave the harm unprevented.
- For effectiveness, assess what the evidence shows the control prevented or limited, and what remains uncertain.
Give reasons for accepting or treating risk
- Explain the reasons for proceeding despite a recognised possibility of harm or loss, or for taking measures to prevent or limit it. Acceptance may be subject to continuing precautions.
- Distinguish the risks someone is willing to take or accept, the limits and conditions for an activity, and the harm or loss they can bear.
- Make clear who may decide, what has been authorised, and which conditions apply.
Apply the framework
Apply this guidance to your own risk or an example.
Plain Risk, developed by Dr Julien Maréchal. © 2026 The Governance Practice.
Original materials: CC BY 4.0. Source. Scope and attribution.
Logos, third-party material, and website software are excluded.