Risk committee decision memo

A decision memo tests the maturity of analysis because it forces a move from describing a problem to authorising a specific action. Do not begin with twenty slides about every risk. Begin with the question the committee can settle today: launch a function, fund a treatment, accept residual exposure for a period or pause part of a service? Put the recommendation in one sentence with scope and condition. Follow it with the business objective, threatening scenario, verified obligation or unresolved applicability, and feasible alternatives. Do not make a temporary decision look permanent when data are provisional. Give it an expiry and reopening trigger. Name the authority that owns the outcome and the control operator who will provide evidence. A decision that specifies neither action nor owner nor timing is description, not governance.

Separate observation, assumption and inference. An observation has a source and date, such as a thirty-minute outage log or an emergency-access exercise result. An assumption might be that demand will rise during a defined season; it can be tested or expressed as a range. The inference is that a limited launch is better than full release or complete deferral under those observations and assumptions. 'The provider is unreliable' turns a limited event into a broad judgment. A more accurate statement is: 'Authentication failed once during the observation period and the recovery exercise did not succeed without provider intervention; we therefore lack evidence for an unrestricted launch.' One incident cannot establish a general failure probability, but it can justify a staged choice proportionate to the evidence gap.

Present alternatives by their effects on several objectives. A full launch may bring value sooner but expose more customers during a common failure. A limited launch preserves a learning opportunity and constrains impact, at extra monitoring cost. Deferral until recovery succeeds protects a necessary boundary but delays service value. Include a rejected alternative and why it was rejected. Failure of an obligation gate differs from merely receiving a low score. If a cost model is used, state its range and time horizon; do not turn nonfinancial harm into zero. The committee should not have to infer how risks connect to resources. Show the effect of each option on the financial cap, engineering capacity and change calendar.

Offer a serious objection to your recommendation before someone else does. If you recommend a limited launch, the objection is that the first small cohort can still be harmed and limited scale does not cure missing data-use authority or weak ledger integrity. Answer directly: authority and ledger gates must pass before any launch. Residual uncertainty about performance can then be tested with a published cap, independent observation and a fast stop. If the gates are not met, do not decorate the choice with the word 'experiment'. A strong objection recognises the rival option's real value; it is not a weak opponent invented for easy defeat. Record dissent and the evidence that could later favour it.

Design the memo so it remains useful after the meeting. Each condition needs closure evidence: an exercise report with recovery timing and emergency-account privilege results, transaction reconciliation showing no duplication, and an exception record naming the approver and expiry. If the committee asks for another control, set its owner, due date and test measure before changing the status to approved. Do not confuse conditional support for a direction with permission to operate. A provider, demand or data-architecture change should activate the reopening trigger. An old decision should not continue merely because no new committee meeting was scheduled. Preserve what was actually known at the time, so later outcomes do not rewrite the decision history.

The committee also needs a review cadence matched to the speed of risk. A quarterly review may suit a stable portfolio choice, but it is too slow for a live-service migration happening in a week. Require a brief daily view during trial, then weekly review after stabilisation, with immediate escalation if a safety gate breaks. More reports do not necessarily mean stronger governance. Select a few actionable indicators: inconsistent cases with their denominator, detection time, recovery-exercise success and expired exceptions still open. State who verifies each data source and who can challenge its interpretation. If a supplier dashboard disagrees with the enterprise ledger, do not choose the more attractive figure. Investigate event definitions and recording times before drawing a conclusion. End with a compact decision record: what the committee approved, what it did not approve, what evidence remains, who will provide it and when authority expires. This prevents a conditional approval from becoming unrestricted permission as it moves through implementation teams.