Consulting Risk Management Framework

Purpose and Scope

This framework defines how risks and opportunities are identified, assessed, treated, monitored, and reported within Agile Lab Consulting.

The objectives are to:

• Provide assurance that Consulting can achieve its strategic, financial, and delivery objectives
• Prevent or reduce undesired effects on customers, people, margins, and reputation
• Enhance delivery quality, predictability, and scalability
• Ensure compliance with laws, regulations, standards, and contractual obligations
• Support continuous improvement across delivery, practices, and governance

Risk is defined as the uncertainty associated with achieving Consulting objectives, including risks related to confidentiality, integrity, and availability of information handled during consulting engagements.

The framework applies to:

• All Business Units (BUs), Delivery Units (DUs), and Practice Units (PUs)
• All delivery models (Fixed Price, Time & Material, Managed Services)
• Consulting support functions (Engineering Office, Sales, Tender Office, Customer Growth, Thought Leadership, Business Development)
• Interfaces with Consulting like People, Training, Internal IT, Finance

Governance Principles

• Federated ownership, centralized visibility
  Risks are identified and managed locally, with centralized consolidation and oversight.

• Predictive focus
  Risks are anticipatory. Once they occur, they transition to incident or problem management.

• KPIs as signals
  KPIs inform probability and impact but are not risks themselves.

• Proportionality
  Risk treatment effort is proportional to exposure and criticality.

• Auditability
  All risks must be traceable to owners, dates, decisions, and outcomes.

Risk Categories

All Consulting risks are classified under one primary category.

Organizational
People, structure, governance, coordination, and operating model risks.

Strategic
Market positioning, service portfolio alignment, scalability, and long-term sustainability risks.

Compliance & Regulation
Legal, regulatory, standard, and contractual compliance risks (e.g. GDPR, ISO/IEC 27001, AI Act, SLAs).

Operational
Day-to-day delivery execution, reliability, continuity, and process effectiveness risks.

Financial
Profitability, pricing, utilization, cost control, and cash flow risks.

Technology & Information Security
Cloud platforms, data platforms, AI systems, access control, and information security risks.

Customer & Market
Customer satisfaction, dependency, churn, reputation, and competitive risks.

Knowledge & Intellectual Capital
Knowledge retention, documentation, skill obsolescence, and IP protection risks.

Risk Identification (Consulting Context)

Risk identification focuses on services, delivery processes, people, knowledge, and customer engagements. AgileLab Consulting may also produce internal software products as business accelerators.

Assets

Assets include:

• Client relationships and contracts
• Consulting services and delivery commitments
• Skills, certifications, and availability of people
• Delivery methodologies and standards
• Customer data, datasets, and environments
• Cloud platforms and shared infrastructure
• Knowledge bases, documentation, accelerators
• Revenue streams and margin targets

Threats

Examples include:

• Loss of key personnel
• Demand volatility or pipeline concentration
• Estimation and planning errors
• Security breaches or misconfigurations
• Regulatory changes
• Platform outages
• Partner dependency
• Competitive pressure

Vulnerabilities

Examples include:

• Scarcity of narrow-practice skills
• Single points of failure
• Weak BU–PU coordination
• Manual or spreadsheet-heavy processes
• Insufficient documentation or onboarding
• Inconsistent application of standards

Impacts

Impacts are assessed in terms of:

• Delivery disruption
• Financial loss or margin erosion
• SLA/SLO breaches
• Customer dissatisfaction or churn
• Reputational damage
• Regulatory penalties
• Loss of intellectual capital

Risk Assessment Method

A 4×4 Probability × Impact model is used.

Probability Scale

• 1 – Unlikely
• 2 – Low Probability
• 3 – Probable
• 4 – Very Likely

Impact Scale

• 1 – Ordinary
• 2 – Significant
• 3 – Severe
• 4 – Catastrophic

Risk Score and Level

Risk Score = Probability × Impact

Risk Treatment Strategies

Permitted strategies:

• Accept – consciously tolerate the risk
• Mitigate – reduce probability and/or impact
• Avoid – eliminate the source of the risk
• Transfer – shift exposure (insurance, contracts, partners)

Relationship with risk level:

• Low: Accept or Monitor
• Medium: Mitigate (acceptance only with justification)
• High: Avoid, Mitigate, or Transfer (never accept)

Risk Status Model

Risk status represents the lifecycle state of a risk.

A materialized risk triggers incident or problem management and post-mortem analysis.

Risk Register

The risk register is located under SHP://Consulting/metrics/ConsultingRiskRegister.

Purpose of the Risk Register

• Consolidate risks from all BUs, DUs, PUs, and functions
• Track ownership, lifecycle, and decisions
• Support audits and management reviews
• Feed executive dashboards
• Preserve organizational learning

Limitations

The Risk Register is not:

• A project plan
• An incident log
• A real-time operational tool

Roles and Responsibilities

Project Managers / DU Leads
Identify and manage delivery risks, link KPIs to probability and impact, escalate Medium and High risks.

Practice Unit Leads
Manage skill, capacity, and knowledge risks, especially for narrow practices.

BU Leads
Own customer, financial, and delivery risks; approve Medium risk acceptance.

SRE / Managed Services Managers
Own continuity, incident, and platform risks; integrate availability and SLO metrics.

Engineering Office
Own technical and architectural risks and enforce standards.

Engineering Director
Oversees systemic risks, process optimization, and portfolio trends.

Consulting Lead
Owns strategic and business risks and arbitrates escalations.

KPI Integration into Risk Monitoring

KPIs are used as early-warning indicators.

Examples:

• CPI, SPI, TCPI → delivery efficiency and predictability risks
• Gross Margin, Utilization → financial sustainability risks
• CSAT → customer and reputation risks
• Incident rate, downtime → operational continuity risks
• Knowledge coverage, turnover → organizational and IP risks

KPIs influence probability, impact, escalation, and mitigation effectiveness.

Review and Continuous Improvement

• Risks are reviewed periodically according to risk level
• Materialized risks require root cause analysis
• Lessons learned generate new preventive risks
• The framework is reviewed annually or upon major organizational change

Summary

This framework establishes a federated, auditable, enterprise-grade risk management system for Consulting, where risks are owned locally, visibility is centralized, decisions are traceable, KPIs inform judgment, and the Risk Register acts as the compliance backbone and exploration hub.

References

• Agile Lab Risk Evaluation Guidelines