Write a Risk Statement: Cause, Event and Consequence

A useful risk statement helps a manager decide what to investigate and what to do. “Delivery risk” names a topic. “Loss of customer trust” names a possible consequence. Neither explains the event the business needs to manage.

Start with the objective

Consider a fictional small online retailer. It wants to fulfil accepted orders within its confirmed delivery promise, protect order margin and maintain customer trust.

For this teaching case, assume website availability is refreshed only overnight while the same stock can be sold through another channel during the day. Assume no effective cross-channel reservation or confirmation check offsets the update lag. These are teaching assumptions, not audit findings. No actual failure rate, loss amount or customer complaint is supplied.

Separate the three elements

The cause or condition explains what could enable the problem. Here it is the assumed mismatch between overnight availability updates and stock movements during the trading day.

The event is what might happen. The retailer may confirm orders for items that are no longer available to fulfil.

The consequence explains why that event matters to the objective. It may lead to cancellations, extra fulfilment costs and reduced customer trust. These are potential outcomes, not findings about a real retailer.

Write the statement

Under the assumed overnight stock-update arrangement, the retailer may confirm orders for items already sold through another channel, leading to cancellations or emergency fulfilment costs and weakening customer trust.

The statement connects an operating condition to an uncertain event and its relevance to the objectives. It is more useful than “poor stock control” because people can challenge each connection.

A simple writing aid

Describe the condition, name the uncertain event, then connect the potential effect to an objective. Keep one main event understandable before adding more causes or consequences.

In the example, “website availability is updated overnight” is a condition. “Orders are confirmed without available stock” is the event. “Extra costs and cancelled orders” are consequences. The placement helps the team understand where a response might work.

Turn the statement into a management conversation

Investigate the condition: compare availability-update logs, stock movements and order-confirmation times. Do not call the update schedule a proven root cause without checking whether it actually explains the exceptions.

Examine the event: review how availability is checked or stock reserved before confirmation. A more frequent update or reservation process may help, but its effectiveness needs testing. Do not assume that buying a new system removes the risk.

Address consequences: consider how to identify unfulfillable orders early and communicate with affected customers. Recovery actions can reduce some effects while leaving other exposures unresolved.

Management should identify an accountable owner for the response and involve the operational and technology teams that need to contribute. Writing the sentence does not transfer that responsibility to internal audit.

What the statement does not tell you

The wording does not provide a likelihood, a loss estimate or a risk rating. Those need evidence, a defined time horizon, the organisation’s assessment criteria and an understanding of current controls.

For example, stock-sync delay, unfulfillable accepted orders and additional fulfilment costs may be useful evidence. Each measure needs a clear definition and a consistent period. For an exception rate, use a comparable accepted-order cohort rather than mixing one period’s accepted orders with another period’s exceptions. A high-sounding consequence should not automatically produce a “High” rating.

Try it yourself

Rewrite “courier risk” for the same fictional retailer. Assume order volume at peak periods can exceed booked carrier pickup capacity.

One possible answer: when peak order volume exceeds booked pickup capacity, packed orders may miss the handover cutoff, delaying delivery and increasing customer-recovery costs.

Self-check: identify the condition, the event and the impact on the delivery objective. Then ask what evidence would test the assumed connection. Do not treat the worked answer as an observation that a real courier failed.

The boundary

The cause–event–consequence structure is a writing aid, not proof that the causal story is correct. Real events can have several interacting causes and consequences. This example explores an adverse scenario; uncertainty can also create opportunities.

HM Treasury’s Orange Book is used as an educational reference for risk language. It is UK public-sector guidance, not a local legal requirement for the fictional retailer.

A good risk statement makes uncertainty discussable. It should improve a decision, not merely fill a risk-register cell.