strategy.risk-mitigation

Skill ID: strategy.risk-mitigation
Name: Risk mitigation
Version: 1.0.0
Admission state: pending
Fabric source commit: 8eb3784b2a9fa5c6f3bb1115d6da44358e45916f
Admission ref: contracts/acp/skills/faithfulness/admissions/strategy.risk-mitigation_successor2_supported_claims.json
Admission digest: sha256:b4f39159c101dbb8afa99b19a0c44e2d52d5e78bf809c60d20d53d2d36af4f11

Declared metadata

purpose

not declared by the Fabric artifact

trigger

not declared by the Fabric artifact

inputs

not declared by the Fabric artifact

outputs

not declared by the Fabric artifact

risk

not declared by the Fabric artifact

model

not declared by the Fabric artifact

locale

not declared by the Fabric artifact

changelog

not declared by the Fabric artifact

deprecation

not declared by the Fabric artifact

support

not declared by the Fabric artifact

Normative statements

`rm-src-1` (sourced)

Risk Management is the co-ordinated activities designed and operated to manage risk and exercise internal control within an organisation. Risk is the effect of uncertainty on objectives. Risk is usually expressed in terms of causes, potential events, and their consequences:

Source references:

{
  "source_clause": "annex-5",
  "source_page": "57",
  "source_ref": "https://www.gov.uk/government/publications/orange-book",
  "source_section_ref": "ob-annex5"
}

`rm-src-2` (sourced)

The board should make a strategic choice about the style, shape and quality of risk management and should lead the assessment and management of opportunity and risk. The board should determine and continuously assess the nature and extent of the principal risks that the organisation is exposed to and is willing to take to achieve its objectives – its risk appetite – and ensure that planning and decision-making reflects this assessment

Source references:

{
  "source_clause": "a3",
  "source_page": "12",
  "source_ref": "https://www.gov.uk/government/publications/orange-book",
  "source_section_ref": "ob-a3"
}

`rm-src-3` (sourced)

Risk evaluation should involve comparing the results of the risk analysis with the nature and extent of risks that the organisation is willing to take – its risk appetite – to determine where and what additional action is required.

Source references:

{
  "source_clause": "d6",
  "source_page": "23",
  "source_ref": "https://www.gov.uk/government/publications/orange-book",
  "source_section_ref": "ob-d6"
}

`rm-der-1` (derived)

Run risk management in this order: determine the organisation's risk appetite at board level; analyse the principal risks expressed in terms of causes, potential events and their consequences; then evaluate the analysis results against the risk appetite to determine where and what additional action is required.

`rm-der-2` (derived)

Move from risk evaluation to deciding on additional action only when the results of the risk analysis have been compared with the organisation's risk appetite; the comparison itself determines where and what additional action is required.

`rm-der-3` (derived)

Stop the risk evaluation and return to the board for a risk-appetite decision if the organisation has not determined or continuously assessed its risk appetite, because without a defined appetite the analysis results cannot be compared to determine where additional action is required.

`rm-der-4` (derived)

Manage risk and exercise internal control through co-ordinated activities across the organisation, and continuously reassess the principal risks the organisation is willing to take so that planning and decision-making stay aligned with the current risk appetite.

Admission reviewer record

{
  "governance": {
    "admission_lane": "independent_review",
    "review_evidence": {
      "deviations": 0,
      "merged_main_commit": "3560d81e2e55894e4aa50a2aa33344955c769d31",
      "note": "Self-asserted review evidence strings copied from Gitea API (PR #2175 review #2440 by codex at 2026-08-14T10:40:49Z, non-stale on exact head 7f00cf96); no cryptographic binding claimed.",
      "pull_request_id": 2175,
      "pull_request_ref": "JaddaHelpifyr/helpifyr-fabric#2175",
      "review_id": 2440,
      "review_state": "APPROVED",
      "reviewed_content_commit": "7f00cf96b74ee5922198147aea92528c754bba20",
      "reviewed_content_ref": "codex/2174-d20-three-skill-full-rewrite",
      "reviewer_identity": "codex",
      "statements_checked": 7
    },
    "review_lane": "independent_review",
    "reviewed_at": "2026-08-18T19:06:17Z",
    "reviewed_by": "codex",
    "source_evidence_pins": {
      "eu-br-toolbox-2023-ch2": {
        "evidence_ref": "contracts/acp/skills/faithfulness/source_evidence/eu-br-toolbox-2023-ch2.json",
        "snapshot_digest": "sha256:1e40c9315a0801639282d8f852ce211de100d7e3fe5f6e0a1eed14842e0b0d05",
        "source_ref": "https://commission.europa.eu/document/download/9c804cbd-e4bf-4267-9e3d-cef4516573bd_en?filename=br_toolbox_-_nov_2021_-_chapter_2.pdf"
      },
      "uk-green-book-2026": {
        "evidence_ref": "contracts/acp/skills/faithfulness/source_evidence/uk-green-book-2026.json",
        "snapshot_digest": "sha256:ff07aad5ce351e3ebd53c0a36710701f0cbfbe3a89b728a664da30b43f3bcf0e",
        "source_ref": "https://www.gov.uk/government/publications/the-green-book-appraisal-and-evaluation-in-central-government"
      },
      "uk-open-policy-making-toolkit": {
        "evidence_ref": "contracts/acp/skills/faithfulness/source_evidence/uk-open-policy-making-toolkit.json",
        "snapshot_digest": "sha256:1c4ec76b87f2d85135485a1937f06d9bac7991ca7128c3c6cce609512ab19790",
        "source_ref": "https://www.gov.uk/guidance/open-policy-making-toolkit"
      },
      "uk-orange-book-2023": {
        "evidence_ref": "contracts/acp/skills/faithfulness/source_evidence/uk-orange-book-2023.json",
        "snapshot_digest": "sha256:2130b738c66e7638b37738d214ad01bfcb96555a040c1275d9a4a48dd81450a5",
        "source_ref": "https://www.gov.uk/government/publications/orange-book"
      }
    }
  },
  "reviewer_verdicts": [
    {
      "evidence_span": "Risk Management is the co-ordinated activities designed and operated to manage risk and exercise internal control within an organisation. Risk is the effect of uncertainty on objectives. Risk is usually expressed in terms of causes, potential events, and their consequences:",
      "evidence_span_digest": "sha256:21b251c73dea9520888f326a4119556fb975de8901414eb6f9841eb66b09d528",
      "outcome": "supported",
      "reviewed_at": "2026-08-18T19:06:17Z",
      "reviewer_id": "codex",
      "section_digest": "sha256:6238fab7a09ea28d66705f4c37733c3db0798e09f2d133f432c389b7dedb7f2b",
      "source_clause": "annex-5",
      "source_page": "57",
      "source_ref": "https://www.gov.uk/government/publications/orange-book",
      "source_section_ref": "ob-annex5",
      "source_snapshot_digest": "sha256:2130b738c66e7638b37738d214ad01bfcb96555a040c1275d9a4a48dd81450a5",
      "statement_digest": "sha256:21b251c73dea9520888f326a4119556fb975de8901414eb6f9841eb66b09d528",
      "statement_id": "rm-src-1",
      "statement_text": "Risk Management is the co-ordinated activities designed and operated to manage risk and exercise internal control within an organisation. Risk is the effect of uncertainty on objectives. Risk is usually expressed in terms of causes, potential events, and their consequences:",
      "support_relation": "direct_quote"
    },
    {
      "evidence_span": "The board should make a strategic choice about the style, shape and quality of risk management and should lead the assessment and management of opportunity and risk. The board should determine and continuously assess the nature and extent of the principal risks that the organisation is exposed to and is willing to take to achieve its objectives – its risk appetite – and ensure that planning and decision-making reflects this assessment",
      "evidence_span_digest": "sha256:87faf677919373bacbfbdb4e03f090f651b47e24d5f5d8a73ea4787f4251d4fe",
      "outcome": "supported",
      "reviewed_at": "2026-08-18T19:06:17Z",
      "reviewer_id": "codex",
      "section_digest": "sha256:de1acc2a9ed1b46ab5523964f54afac8ed3bc6801c21b649d0e06df9f2651f53",
      "source_clause": "a3",
      "source_page": "12",
      "source_ref": "https://www.gov.uk/government/publications/orange-book",
      "source_section_ref": "ob-a3",
      "source_snapshot_digest": "sha256:2130b738c66e7638b37738d214ad01bfcb96555a040c1275d9a4a48dd81450a5",
      "statement_digest": "sha256:87faf677919373bacbfbdb4e03f090f651b47e24d5f5d8a73ea4787f4251d4fe",
      "statement_id": "rm-src-2",
      "statement_text": "The board should make a strategic choice about the style, shape and quality of risk management and should lead the assessment and management of opportunity and risk. The board should determine and continuously assess the nature and extent of the principal risks that the organisation is exposed to and is willing to take to achieve its objectives – its risk appetite – and ensure that planning and decision-making reflects this assessment",
      "support_relation": "direct_quote"
    },
    {
      "evidence_span": "Risk evaluation should involve comparing the results of the risk analysis with the nature and extent of risks that the organisation is willing to take – its risk appetite – to determine where and what additional action is required.",
      "evidence_span_digest": "sha256:3a2be3bb2a330f53ee8866336ce1218d58361ebc57fdd505dd2d74ccdb1a895a",
      "outcome": "supported",
      "reviewed_at": "2026-08-18T19:06:17Z",
      "reviewer_id": "codex",
      "section_digest": "sha256:92979ef23d21e4234af855821ce3ebe3339610986c7eada504c136140a7452af",
      "source_clause": "d6",
      "source_page": "23",
      "source_ref": "https://www.gov.uk/government/publications/orange-book",
      "source_section_ref": "ob-d6",
      "source_snapshot_digest": "sha256:2130b738c66e7638b37738d214ad01bfcb96555a040c1275d9a4a48dd81450a5",
      "statement_digest": "sha256:3a2be3bb2a330f53ee8866336ce1218d58361ebc57fdd505dd2d74ccdb1a895a",
      "statement_id": "rm-src-3",
      "statement_text": "Risk evaluation should involve comparing the results of the risk analysis with the nature and extent of risks that the organisation is willing to take – its risk appetite – to determine where and what additional action is required.",
      "support_relation": "direct_quote"
    },
    {
      "derived_from_statement_ids": [
        "rm-src-1",
        "rm-src-2",
        "rm-src-3"
      ],
      "outcome": "supported",
      "reviewed_at": "2026-08-18T19:06:17Z",
      "reviewer_id": "codex",
      "statement_digest": "sha256:e6ac3f8567d40df39f25d51c77c891f6fa51c09cc566d702f5eac67796394ba5",
      "statement_id": "rm-der-1",
      "statement_text": "Run risk management in this order: determine the organisation's risk appetite at board level; analyse the principal risks expressed in terms of causes, potential events and their consequences; then evaluate the analysis results against the risk appetite to determine where and what additional action is required."
    },
    {
      "derived_from_statement_ids": [
        "rm-src-3"
      ],
      "outcome": "supported",
      "reviewed_at": "2026-08-18T19:06:17Z",
      "reviewer_id": "codex",
      "statement_digest": "sha256:b79287347f61039a4cccc85b4c912b340bceadfe544fa46a0addecaf158f7d54",
      "statement_id": "rm-der-2",
      "statement_text": "Move from risk evaluation to deciding on additional action only when the results of the risk analysis have been compared with the organisation's risk appetite; the comparison itself determines where and what additional action is required."
    },
    {
      "derived_from_statement_ids": [
        "rm-src-2",
        "rm-src-3"
      ],
      "outcome": "supported",
      "reviewed_at": "2026-08-18T19:06:17Z",
      "reviewer_id": "codex",
      "statement_digest": "sha256:a5bbf3fa38e058000b4daf3a86e6f8c8d6d6e65a6402aa2dd8be26b4f4aa01da",
      "statement_id": "rm-der-3",
      "statement_text": "Stop the risk evaluation and return to the board for a risk-appetite decision if the organisation has not determined or continuously assessed its risk appetite, because without a defined appetite the analysis results cannot be compared to determine where additional action is required."
    },
    {
      "derived_from_statement_ids": [
        "rm-src-1",
        "rm-src-2"
      ],
      "outcome": "supported",
      "reviewed_at": "2026-08-18T19:06:17Z",
      "reviewer_id": "codex",
      "statement_digest": "sha256:874a757d0c6b9f8ba6bd806a41bc560bb81511feaa19cf7bab4f6a25109fea1a",
      "statement_id": "rm-der-4",
      "statement_text": "Manage risk and exercise internal control through co-ordinated activities across the organisation, and continuously reassess the principal risks the organisation is willing to take so that planning and decision-making stay aligned with the current risk appetite."
    }
  ]
}

This page is generated from a Fabric projection; it contains no tenant-scoped definitions or private evidence.

Licensed under AGPLv3. See https://helpifyr.com.

Declared metadata​

purpose​

trigger​

inputs​

outputs​

risk​

model​

locale​

changelog​

deprecation​

support​

Normative statements​

rm-src-1 (sourced)​

rm-src-2 (sourced)​

rm-src-3 (sourced)​

rm-der-1 (derived)​

rm-der-2 (derived)​

rm-der-3 (derived)​

rm-der-4 (derived)​

Admission reviewer record​

Declared metadata

purpose

trigger

inputs

outputs

risk

model

locale

changelog

deprecation

support

Normative statements

`rm-src-1` (sourced)

`rm-src-2` (sourced)

`rm-src-3` (sourced)

`rm-der-1` (derived)

`rm-der-2` (derived)

`rm-der-3` (derived)

`rm-der-4` (derived)

Admission reviewer record