A control without a risk is an activity. A risk without an owner is a worry. Risk management joins the two: what could go wrong, how serious it is, and the decision the organisation has made.
What the record has to show
How risk management is done walks through that method. How risk management helps describes the product.
- The risk itself, the assets it touches, and where it came from.
- How likely it is, and how bad it would be, before controls and after them.
- The decision: treat, accept, avoid, or transfer.
- The non-conformities and improvements that came out of the same work.