Risk & Excellence
Practical thinking on resilience, performance and continual improvement.
Explore practical ways to connect risk management, resilience and continual improvement with accountable decisions. The articles in this section focus on how teams recognise a problem, choose a response and check whether it worked. Use them when a register needs clearer ownership, a corrective action needs an effectiveness check or an exercise needs a useful decision record.
Start with the work you need to do
Reader worksheets →Page 1 of 2 · Articles 1–24 of 26. Browse the numbered pages to explore the complete collection.
Should your Pareto chart rank defects by count or by cost?
A fictional dispatch log shows why frequent small defects and rare expensive failures lead to different priorities—and how to make the choice explicit.
Why is Cpk low when Cp looks good?
A worked Cpk calculation shows how a narrow process spread can still sit too close to one specification limit, and what evidence to check next.
How to calculate first-pass yield when rework hides the result
A worked batch ledger separates first-pass success from rework recovery and shows what to report when some units remain unfinished.
How to calculate cost of poor quality without double counting
A worked monthly ledger shows how to calculate failure costs, separate supplier recoveries and spot duplicate scrap entries before making an improvement decision.
A risk score should not close a quality risk assessment
A worked ICH Q9(R1) decision record showing how evidence, uncertainty, controls and review triggers turn a score into a defensible pharmaceutical quality-risk decision.
A risk appetite statement should change the next decision
Turn a Malaysian risk appetite statement into usable decision boundaries, evidence and escalation, with clear distinctions from individual risk acceptance.
Continuity plans age between annual reviews
Review a continuity plan when its service assumptions change. A South African guide to review intervals, targeted checks and evidence for approving updates.
When a supplier change reopens the risk assessment
Use service changes, incidents and evidence gaps to reopen a UK supplier assessment before the next scheduled questionnaire.
Singapore heat stress readiness begins before 1 December
Four heat-stress practices become mandatory in Singapore on 1 December 2026. The real test is whether supervisors can make safe decisions in the field, not whether a policy has been reissued.
Australia workplace exposure limits need a control change not a label change
The 1 December change from workplace exposure standards to workplace exposure limits can affect more than terminology. This briefing turns the national transition into a control and evidence review.
Two employers, one maintenance job: where lockout coordination can fail
Host and contractor procedures need to meet at the job. A permit alone cannot establish that everyone understands the energy-control arrangements.
Test whether food traceability records can answer a mock recall
Run a controlled traceability test that reconciles lot identity, quantities, locations and exceptions without simulating a real recall notice.
The supplier email looks genuine. Has the bank account changed?
Use an independent callback, controlled supplier-record change and payment approval to check changed bank details before funds leave the business.
A near miss is a warning, not a safety score
Near-miss counts need context. Examine exposure, reporting changes, investigation quality and action effectiveness before treating a trend as a safety result.
Make the NIS2 reporting clock visible before an incident
Prepare NIS2 incident reporting with awareness logs, applicable deadlines, escalation owners and staged evidence handoffs.
Reconcile manual outage records before normal processing resumes
Control temporary records, duplicate transactions and handback decisions when teams work manually during a system outage.
A backup test is complete when the business can use the restore
Define restore acceptance before a recovery exercise. Check usable records, permissions and dependencies as well as elapsed technical recovery time.
Map the dependencies behind your first recovery priority
Make a business impact analysis usable by linking a critical activity to its people, data, systems, suppliers and minimum workable service.
Give a risk acceptance an owner and an expiry condition
Document the residual risk, approving authority and review triggers so an accepted exception does not become an indefinite permission to bypass a control.
Test an outsourced service exit before the contract ends
Build an exit sequence around usable data, replacement access and verified handover so ending a supplier contract does not interrupt critical work.
Check whether backup suppliers share the same dependency
Look beyond supplier names to identify shared sites, infrastructure and upstream dependencies that could prevent a backup arrangement from working.
Check the denominator before trusting an improving KPI
Test whether an improving KPI reflects better performance or a changed population using a definition record, reconciliation and a worked example.
Test whether the incident contact tree reaches a decision maker
Run a controlled contact-tree exercise that checks acknowledgement, deputy cover and decision authority without creating a false emergency.
A recovery tabletop that tests business decisions
Test whether people can make recovery decisions with the information and authority available, then identify what needs a separate technical restore test.
Move from a record to a tested response
A risk register becomes useful when people can see the current controls, the remaining uncertainty and the next decision. Look for named responsibilities, realistic review dates and escalation triggers. A risk score alone cannot explain what action is appropriate or whether a control is operating as intended.
Corrective-action coverage separates completing a task from demonstrating an improvement. The relevant evidence depends on the original problem and the result the organisation needs. An effectiveness check should make that connection visible, including what would justify reopening an action or taking a different approach.
Resilience articles examine the decisions behind a recovery exercise: who declares an incident, which services matter, how dependencies affect recovery and when a fallback is acceptable. Hypothetical examples are starting points for discussion rather than tested recovery instructions for your systems. Read across the governance and AI sections when responsibilities, data or automated work form part of the risk.