Skip to main content

work.risk-and-escalation

  • Skill ID: work.risk-and-escalation
  • Name: Risk and escalation
  • Version: 1.0.0
  • Admission state: pending
  • Fabric source commit: 8eb3784b2a9fa5c6f3bb1115d6da44358e45916f
  • Admission ref: contracts/acp/skills/faithfulness/admissions/work.risk-and-escalation_successor2_supported_claims.json
  • Admission digest: sha256:d92c76e7ad69af815445d20566ed57da83d5884d55ad8edcb5ffbf714a4b2e2e

Declared metadata​

purpose​

not declared by the Fabric artifact

trigger​

not declared by the Fabric artifact

inputs​

not declared by the Fabric artifact

outputs​

not declared by the Fabric artifact

risk​

not declared by the Fabric artifact

model​

not declared by the Fabric artifact

locale​

not declared by the Fabric artifact

changelog​

not declared by the Fabric artifact

deprecation​

not declared by the Fabric artifact

support​

not declared by the Fabric artifact

Normative statements​

rae-src-1 (sourced)​

The board should determine and continuously assess the nature and extent of the principal risks that the organisation is exposed to and is willing to take to achieve its objectives – its risk appetite – and ensure that planning and decision-making reflects this assessment

Source references:

{
  "source_clause": "a3",
  "source_page": "12",
  "source_ref": "https://www.gov.uk/government/publications/orange-book",
  "source_section_ref": "ob-a3"
}

rae-src-2 (sourced)​

Risk evaluation should involve comparing the results of the risk analysis with the nature and extent of risks that the organisation is willing to take – its risk appetite – to determine where and what additional action is required.

Source references:

{
  "source_clause": "d6",
  "source_page": "23",
  "source_ref": "https://www.gov.uk/government/publications/orange-book",
  "source_section_ref": "ob-d6"
}

rae-src-3 (sourced)​

Risk Management is the co-ordinated activities designed and operated to manage risk and exercise internal control within an organisation. Risk is the effect of uncertainty on objectives. Risk is usually expressed in terms of causes, potential events, and their consequences:

Source references:

{
  "source_clause": "annex-5",
  "source_page": "57",
  "source_ref": "https://www.gov.uk/government/publications/orange-book",
  "source_section_ref": "ob-annex5"
}

rae-der-1 (derived)​

Escalate to the board any risk for which the analysis results cannot be compared with the organisation's risk appetite, because the board determines and continuously assesses the risk appetite and leads the assessment and management of opportunity and risk.

rae-der-2 (derived)​

Determine where and what additional action is required only after comparing the results of the risk analysis with the organisation's risk appetite; where the appetite has not been established, obtain the board's strategic decision on the risk appetite before proceeding.

rae-der-3 (derived)​

Escalate risk information in terms of its causes, potential events, and their consequences so that the effect of uncertainty on objectives can be compared against the risk appetite and the required additional action determined.

rae-der-4 (derived)​

Treat the continuously assessed risk appetite as the reference point for escalation decisions: when the level of risk is not within the appetite the organisation is willing to take, escalate to the board for a decision on where and what additional action is required.

Admission reviewer record​

{
  "governance": {
    "admission_lane": "independent_review",
    "review_evidence": {
      "deviations": 0,
      "merged_main_commit": "40777098f9c6c4293f8ad04e1b3edccaad47717f",
      "note": "Self-asserted review evidence strings copied from Gitea API (PR #2297 review #2830 by codex at 2026-08-18T09:38:35Z, non-stale on exact head 4a0165c8, D27 verbatim-quote content repair review). PR #2295 (supersession, review #2809 by codex, APPROVED, merge_commit 66ad5d7353d4cf3616bfd3dbfcad7753c64039e7) established the base supersession ahead of this content repair; see manifest supersessions.work.risk-and-escalation. No cryptographic binding claimed.",
      "pull_request_id": 2297,
      "pull_request_ref": "JaddaHelpifyr/helpifyr-fabric#2297",
      "review_id": 2830,
      "review_state": "APPROVED",
      "reviewed_content_commit": "4a0165c80f3d7ef7fcacdae7e7b6bcc44ddbe954",
      "reviewed_content_ref": "fix/1960-verbatim-content",
      "reviewer_identity": "codex",
      "statements_checked": 7
    },
    "review_lane": "independent_review",
    "reviewed_at": "2026-08-18T19:06:17Z",
    "reviewed_by": "codex",
    "source_evidence_pins": {
      "uk-orange-book-2023": {
        "evidence_ref": "contracts/acp/skills/faithfulness/source_evidence/uk-orange-book-2023.json",
        "snapshot_digest": "sha256:2130b738c66e7638b37738d214ad01bfcb96555a040c1275d9a4a48dd81450a5",
        "source_ref": "https://www.gov.uk/government/publications/orange-book"
      }
    }
  },
  "reviewer_verdicts": [
    {
      "evidence_span": "The board should determine and continuously assess the nature and extent of the principal risks that the organisation is exposed to and is willing to take to achieve its objectives – its risk appetite – and ensure that planning and decision-making reflects this assessment",
      "evidence_span_digest": "sha256:eecb055cfc9797f5c166d48c6e87cdaf59748e99f378e660dc1cebdca2d431bd",
      "outcome": "supported",
      "reviewed_at": "2026-08-18T19:06:17Z",
      "reviewer_id": "codex",
      "section_digest": "sha256:de1acc2a9ed1b46ab5523964f54afac8ed3bc6801c21b649d0e06df9f2651f53",
      "source_clause": "a3",
      "source_page": "12",
      "source_ref": "https://www.gov.uk/government/publications/orange-book",
      "source_section_ref": "ob-a3",
      "source_snapshot_digest": "sha256:2130b738c66e7638b37738d214ad01bfcb96555a040c1275d9a4a48dd81450a5",
      "statement_digest": "sha256:eecb055cfc9797f5c166d48c6e87cdaf59748e99f378e660dc1cebdca2d431bd",
      "statement_id": "rae-src-1",
      "statement_text": "The board should determine and continuously assess the nature and extent of the principal risks that the organisation is exposed to and is willing to take to achieve its objectives – its risk appetite – and ensure that planning and decision-making reflects this assessment",
      "support_relation": "direct_quote"
    },
    {
      "evidence_span": "Risk evaluation should involve comparing the results of the risk analysis with the nature and extent of risks that the organisation is willing to take – its risk appetite – to determine where and what additional action is required.",
      "evidence_span_digest": "sha256:3a2be3bb2a330f53ee8866336ce1218d58361ebc57fdd505dd2d74ccdb1a895a",
      "outcome": "supported",
      "reviewed_at": "2026-08-18T19:06:17Z",
      "reviewer_id": "codex",
      "section_digest": "sha256:92979ef23d21e4234af855821ce3ebe3339610986c7eada504c136140a7452af",
      "source_clause": "d6",
      "source_page": "23",
      "source_ref": "https://www.gov.uk/government/publications/orange-book",
      "source_section_ref": "ob-d6",
      "source_snapshot_digest": "sha256:2130b738c66e7638b37738d214ad01bfcb96555a040c1275d9a4a48dd81450a5",
      "statement_digest": "sha256:3a2be3bb2a330f53ee8866336ce1218d58361ebc57fdd505dd2d74ccdb1a895a",
      "statement_id": "rae-src-2",
      "statement_text": "Risk evaluation should involve comparing the results of the risk analysis with the nature and extent of risks that the organisation is willing to take – its risk appetite – to determine where and what additional action is required.",
      "support_relation": "direct_quote"
    },
    {
      "evidence_span": "Risk Management is the co-ordinated activities designed and operated to manage risk and exercise internal control within an organisation. Risk is the effect of uncertainty on objectives. Risk is usually expressed in terms of causes, potential events, and their consequences:",
      "evidence_span_digest": "sha256:21b251c73dea9520888f326a4119556fb975de8901414eb6f9841eb66b09d528",
      "outcome": "supported",
      "reviewed_at": "2026-08-18T19:06:17Z",
      "reviewer_id": "codex",
      "section_digest": "sha256:6238fab7a09ea28d66705f4c37733c3db0798e09f2d133f432c389b7dedb7f2b",
      "source_clause": "annex-5",
      "source_page": "57",
      "source_ref": "https://www.gov.uk/government/publications/orange-book",
      "source_section_ref": "ob-annex5",
      "source_snapshot_digest": "sha256:2130b738c66e7638b37738d214ad01bfcb96555a040c1275d9a4a48dd81450a5",
      "statement_digest": "sha256:21b251c73dea9520888f326a4119556fb975de8901414eb6f9841eb66b09d528",
      "statement_id": "rae-src-3",
      "statement_text": "Risk Management is the co-ordinated activities designed and operated to manage risk and exercise internal control within an organisation. Risk is the effect of uncertainty on objectives. Risk is usually expressed in terms of causes, potential events, and their consequences:",
      "support_relation": "direct_quote"
    },
    {
      "derived_from_statement_ids": [
        "rae-src-1",
        "rae-src-2"
      ],
      "outcome": "supported",
      "reviewed_at": "2026-08-18T19:06:17Z",
      "reviewer_id": "codex",
      "statement_digest": "sha256:56d7c3888d953329a14c3f3028e7344787c7270f16a641b2c37911a173f7831b",
      "statement_id": "rae-der-1",
      "statement_text": "Escalate to the board any risk for which the analysis results cannot be compared with the organisation's risk appetite, because the board determines and continuously assesses the risk appetite and leads the assessment and management of opportunity and risk."
    },
    {
      "derived_from_statement_ids": [
        "rae-src-1",
        "rae-src-2"
      ],
      "outcome": "supported",
      "reviewed_at": "2026-08-18T19:06:17Z",
      "reviewer_id": "codex",
      "statement_digest": "sha256:7d5aa19b199a361e51b3cf829df3427a21d115136bd18955191cb1a0f685a1d6",
      "statement_id": "rae-der-2",
      "statement_text": "Determine where and what additional action is required only after comparing the results of the risk analysis with the organisation's risk appetite; where the appetite has not been established, obtain the board's strategic decision on the risk appetite before proceeding."
    },
    {
      "derived_from_statement_ids": [
        "rae-src-2",
        "rae-src-3"
      ],
      "outcome": "supported",
      "reviewed_at": "2026-08-18T19:06:17Z",
      "reviewer_id": "codex",
      "statement_digest": "sha256:03a3bd797cc44c47bf26a33fd663a675f4e6aaaff9edcbd43c2a00b74031763e",
      "statement_id": "rae-der-3",
      "statement_text": "Escalate risk information in terms of its causes, potential events, and their consequences so that the effect of uncertainty on objectives can be compared against the risk appetite and the required additional action determined."
    },
    {
      "derived_from_statement_ids": [
        "rae-src-1",
        "rae-src-2"
      ],
      "outcome": "supported",
      "reviewed_at": "2026-08-18T19:06:17Z",
      "reviewer_id": "codex",
      "statement_digest": "sha256:d731f05b589ed86543e34647232325417d6f19cc5f4c011ac704d2a5d35efef9",
      "statement_id": "rae-der-4",
      "statement_text": "Treat the continuously assessed risk appetite as the reference point for escalation decisions: when the level of risk is not within the appetite the organisation is willing to take, escalate to the board for a decision on where and what additional action is required."
    }
  ]
}

This page is generated from a Fabric projection; it contains no tenant-scoped definitions or private evidence.

Licensed under AGPLv3. See https://helpifyr.com.