Structured judgement for uncertain conditions.

Identification starts with objectives, not threats. Before asking what could go wrong, it is necessary to understand what the person, family or organisation is trying to do — live privately, travel for business, host an event, run a site — and what they value most. A risk is then anything uncertain that could affect those objectives.

Information comes from conversations with the client and those around them, observation of places and routines, review of existing arrangements and past concerns, and reputable open sources about the wider environment. Each risk is described precisely, as a cause, an event and a consequence. “Unauthorised access to the residence through an unmonitored service entrance” is useful; “security” is not.

Each identified risk is examined for two things: how likely it is to occur within the relevant period, and how serious the consequences would be if it did. Both are judged against clear qualitative scales, so that different assessors reach comparable conclusions and clients can follow the reasoning.

Good assessment considers existing controls honestly — what is already in place and how well it actually works in practice — and records the evidence behind each rating. Where information is limited, the uncertainty is stated rather than hidden. An assessment that sounds confident but cannot explain itself is of little use to anyone.

Not every risk deserves the same attention, and time, money and goodwill are always finite. Prioritisation ranks risks by their assessed level, then tempers that ranking with judgement. Risks that could develop quickly, those with severe consequences even when unlikely, and those that affect people rather than property often warrant earlier attention.

This stage also compares each risk with what the client is prepared to accept — their risk appetite — so that effort concentrates where the gap between current and acceptable exposure is widest. The aim is a short, honest list of what matters most, not a long one in which everything appears urgent.

For each priority risk the question becomes what response is proportionate. Recognised treatment options include avoiding the activity that creates the risk, reducing its likelihood or impact, sharing it — through insurance or contractual arrangements, for example — or accepting it knowingly where treatment would cost more than it saves.

Measures are chosen as a balanced set: changes to routines and procedures, physical and technical measures, training and awareness and, where genuinely justified and lawful, protective services. Each has an owner, a timescale and a plain statement of what it is meant to achieve. The least intrusive effective option is usually the right place to start.

Risks and controls both change. Profiles rise and fall, routines shift, environments evolve, and measures that once worked well quietly erode through familiarity. Monitoring keeps the picture current by checking that agreed measures are in place and effective, and by noticing early signals that a risk is growing or fading.

Monitoring should be proportionate too: light, regular checks for most risks and closer attention for the few that are higher or more volatile. Defined triggers — a change of residence, a new travel pattern, a significant incident nearby — prompt an unscheduled review rather than waiting for the calendar.

The final stage turns experience into better arrangements. After incidents, near-misses, exercises and scheduled reviews, the questions are simple: what worked, what did not, and what should change? Honest answers are recorded without blame, because a culture that hides problems loses the chance to fix them.

Improvements flow back into the first stage. Objectives are re-confirmed, new risks identified and redundant measures retired — which matters as much as adding new ones. Over time, this is what keeps an arrangement proportionate, credible and suited to the client’s life or organisation as it is now, rather than as it was.