Unit 10.04: The risk review someone can challenge

The deliverable is a document a reviewer can argue with.

Measured, controlled, accepted, untested

What it does, what it measured, what controls exist, what risks are accepted, and what has not been tested.

Below is the review.

{
  "workflow": "invoice overdue checks",
  "autonomy": "acts after explicit approval, credits only, max 500",
  "measured": {
    "automated_share": 0.62,
    "hours_saved_per_month": 37,
    "error_rate": "4% vs 2% manual",
    "approval_violations": 0
  },
  "controls": [
    "read-only tools except one",
    "argument validation with a 500 ceiling",
    "approval gate before the only irreversible action",
    "idempotency key on post_credit",
    "five stopping rules"
  ],
  "accepted_risks": [
    {
      "risk": "error rate is double the manual process",
      "mitigation": "every credit reviewed before posting",
      "residual": "medium, reviewed monthly"
    },
    {
      "risk": "staleness on balances older than one day",
      "mitigation": "re-fetch when older than the budget",
      "residual": "low"
    }
  ],
  "not_tested": [
    "two approvers on one credit",
    "concurrent runs on one invoice"
  ],
  "owner": "finance systems team",
  "next_steps": [
    "test the two-approver path",
    "re-measure error rate in 3 months"
  ]
}

the error rate being WORSE than manual is stated, with the trade

The error rate being *worse* than the manual process is stated plainly, with the mitigation and a monthly review. That is the number a review is most tempted to omit, and omitting it means the next person discovers it from a complaint.

not_tested names two specific gaps. Listing them lets a reviewer weigh the exposure rather than discover it, and it is the section that tells them whether the analysis was thorough.

The mistake this prevents

The mistake is writing the review for sign-off rather than for the person who inherits the system. Reviews written for approval omit the unflattering metric, list no untested areas, and name no owner - and they are read once, by someone who will not maintain it.

Takeaway

State the metrics that look bad along with the trade, list what you have not tested, and name an owner. A review with nothing challengeable in it has not been reviewed.

Mark complete