Closing the Loop: Making Risk Closure a Genuine Transfer of Accountability

Walk into almost any delivery assurance review in the UK and you will be shown a risk register. It will be colour-coded, it will be long, and it will almost certainly include a healthy proportion of items marked as closed. What it will rarely show is whether those closures meant anything. Ask a programme team in November how many risks were closed in the spring, and how many have since returned under a slightly different description, and the answer is usually uncomfortable.

A quiet risk is not a closed risk

Two things are supposed to happen when a risk is closed. Monitoring stops, and accountability moves somewhere else. In practice, only the first tends to occur. The register entry is updated, the red or amber cell becomes a green one, and the item drops off the review agenda. The exposure itself does not disappear; it merely stops being anybody's stated responsibility.

This is why the same issues tend to reappear at the point of go-live, or six months into business as usual, wearing a new hat. The supplier dependency that was marked as transferred is still a supplier dependency. The resourcing risk that was marked as mitigated was mitigated against a plan that has since changed. Closure became an event in a document rather than a change in the operating environment.

Four legitimate destinations for a risk

A risk should only leave the register when it has arrived somewhere. There are four defensible destinations, and each requires evidence rather than assertion.

Mitigated

The control is in place and has been observed working, not merely designed. The residual exposure is described in plain terms, and the person holding that residual is named. If the mitigation is a new process step, there should be at least one instance of it having been performed and checked.

Transferred

Another party now bears the consequence — typically through contract, insurance or a formal service agreement. Transfer is rarely total, so the residual retained by the organisation should be stated explicitly alongside the reference of the instrument that carries the rest. A supplier accepting a risk in a schedule of terms is not the same as a supplier accepting it in practice.

Accepted

An accountable executive has consciously decided to live with the exposure, within a tolerance they can articulate. Acceptance without a named individual, a stated tolerance and a review date is not acceptance; it is neglect with better formatting.

Owned in business as usual

The risk has migrated into the operational estate and now sits with a manager who has the authority and the budget to act on it. This is the most common destination and the one most often fudged, because it depends on a handover conversation that nobody has scheduled.

What a closure entry must survive

A useful test is whether a newly appointed programme manager could read a closure entry cold and know what to do. That requires five things: what changed, what exposure remains, who holds it, what would cause it to be reopened, and the date on which the mitigating evidence was last seen. Anything less is a note to self rather than a record of transfer.

It is also worth being strict about language. Phrases such as no longer a concern, addressed through existing arrangements and managed by the team are signals that nobody has actually taken custody.

Handover is where closure is won or lost

The least glamorous step is also the most decisive. Operational owners are frequently introduced to risks in the final fortnight of a programme, at which point they inherit a list they had no part in shaping and no budget to manage. Predictably, the items drift back into a project forum or emerge later as incidents.

Bringing the receiving manager into the conversation earlier — while the mitigation is still being designed — changes the nature of the closure. They can challenge whether the control will survive contact with daily operations, negotiate the funding that sits behind it, and confirm in their own words what they are accepting. That conversation is the closure. The register edit simply records it.

Making the pattern visible

Two unglamorous measures will tell an organisation more about its risk discipline than any heat map. The first is a reopening rate: the proportion of risks closed in the previous twelve months that have since been reinstated in any form, including under a new description. The second is a quarterly sample audit of ten closed items, tracing each to its destination and to the named owner.

Assurance reviews should ask the same question of every closure: who holds this now, and can we speak to them? Where the answer is a committee, a team or a shared inbox, the risk has not moved at all.

A practical closure standard

Six requirements, applied consistently, will remove most of the ambiguity:

• A stated destination from the four options above, with supporting evidence where relevant.
• A named individual, with a role, not a function or a group.
• A plain-language description of the residual exposure.
• A stated tolerance or threshold, however approximate.
• A pre-agreed reopen trigger, written down before closure.
• A review date, even if the decision at that review is simply to leave it alone.

None of this is elaborate. It is the difference between a register that records history and one that records custody. Projects do not fail because risks were identified late; they fail because risks were declared finished before anyone had taken them on. Clearer delivery starts with being honest about where a risk has actually gone.