Decision Library
Choose a treatment, not another row in the register
A risk register is a list of things that might go wrong. A risk decision is narrower and harder: for one risk, which treatment to fund, which to decline, and what loss the organization is willing to carry. A Decision Room compares the treatments side by side and keeps the residual risk in plain view.
Argumont is decision support. It is not insurance, legal, or security advice.
Four treatments
Risk practice has long grouped the responses into four. Avoid the risk by stopping the activity. Reduce it with controls that lower the likelihood or the impact. Transfer part of it through insurance or a contract. Accept it, deliberately, with an owner and a date to revisit.
Most real choices combine two of them, such as reducing a risk and insuring what remains.
Estimate in ranges
An expected loss multiplies how often an event might happen by what it would cost, and a range is more honest than a single figure. A loss of $400,000 to $2 million, expected once in ten to twenty years, works out to roughly $20,000 to $200,000 a year, which is a clearer basis for a decision than the color red on a heat map.
Heat maps are useful for sorting and poor at comparing treatments, because the colors hide both the uncertainty and the arithmetic. Ask of each treatment how much it shortens the path from cause to loss, and what failure of the treatment itself would look like.
Evidence that carries weight
Incident and near-miss history, results of control tests rather than control descriptions, the exact wording of insurance exclusions and deductibles, contract terms that shift liability, and the full cost of each treatment, including the operational drag it adds. A quiet year is weak evidence of safety, and near misses are often the better guide.
How the room argues a treatment
Each treatment gets a Champion, acceptance included, so that carrying a risk is argued openly instead of happening by default. The Red Teamer runs the event against each treatment to see where it fails. The Inspector reads the policy wording and contract terms against the claim that the risk has been transferred, and Aslan weighs who bears the loss if the treatment fails, from customers to staff.
The Verdict names the leading treatment, the residual risk it leaves, and the evidence that would change it. The risk owner records the Human Decision, and any acceptance carries its review date.
What to weigh
Loss reduction
How far the treatment shortens the path from cause to loss, by likelihood or impact.
Residual risk
The loss that remains after the treatment, stated as a range.
Treatment cost
Money, staff time and operational drag over the period it runs.
Treatment reliability
Whether failure of the treatment itself would be noticed in time.
Coverage certainty
For transfers, whether the policy or contract wording actually covers this event.
Where it goes wrong
Control theater
The organization feels safer while the loss path stays the same length.
Transfer illusion
Insurance language is assumed to cover an event its exclusions leave out.
Acceptance by default
A risk is carried because nobody decided, so nobody revisits it.
Ransomware at a distribution business
A distribution company estimates a serious ransomware event at once in ten to twenty years, costing $400,000 to $2 million in downtime and recovery. The options are a $48,000 annual policy with a $250,000 deductible, a $120,000 project for offline backups and faster restoration, both together, or accepting the risk for a year. A restoration test shows the current backups take nine days to restore, which drives most of the loss. With weights of loss reduction 35, residual risk 25, treatment cost 20, reliability 10 and coverage certainty 10, the backup project leads, because shorter downtime cuts the loss whether or not a policy pays. The Verdict names what would add the policy as well: restoration still taking more than three days after the project, which would leave losses large enough for coverage above the deductible to matter.
Questions
- Can the room read our insurance policy?
- Paste the relevant wording, especially exclusions and deductibles. The Inspector checks whether the text supports the claim that a given event is covered. Your broker and counsel remain the authority on what the policy means.
- If acceptance wins, is the room saying to do nothing?
- Acceptance is a decision with a stated loss, an owner and a review date. When it leads, the Verdict says what the organization is choosing to carry and for how long.
Bring Argumont a Decision worth challenging.
Start with a paid 60 day pilot on your own real Decisions.