ROAM is a collaborative risk-treatment practice for planning and review. Owned is an interim state with accountability, Accepted requires an authorised decision, Mitigated requires a concrete plan, and Resolved requires evidence that the concern has ended.

1. 1

   Prepare

   Qualify risks for ROAM

   

   Goal

   Provide a bounded, understandable list of relevant risks with consequence and context.

   Inputs for this step

   • Current risks from planning or register
   • Objectives and affected dependencies
   • Existing assessment or urgency

   Actions

   • Separate duplicates and issues that have already occurred.
   • Write each risk as a possible event with consequence.
   • Include only risks within the joint decision scope.

   Output

   Qualified risk list

   Risk scenario · consequence · context · urgency

   Quality check

   Is every item a risk rather than a task or issue? Is the affected objective clear?

   Pitfall

   The board fills with vague worries and operational tasks that cannot support a ROAM decision. Rewrite items as risk scenarios or move them to issue and action lists.

   Timing: 5–10 minutes

2. 2

   Decide

   ROAM every risk

   

   Goal

   Choose the appropriate treatment and record the decision rationale.

   Inputs for this step

   • Qualified risks
   • Response options and decision authority
   • People with risk and delivery knowledge

   Actions

   • Check whether evidence shows the risk no longer exists: Resolved.
   • If more work is needed, distinguish Owned, Accepted, and Mitigated.
   • Record the decision rationale and remaining uncertainty on the card.

   Output

   ROAM assignment

   Category · rationale · residual uncertainty

   Quality check

   Can the category be traced to a criterion? Is Owned kept distinct from Mitigated and Resolved?

   Pitfall

   Risks are placed in the most convenient column without rationale or residual uncertainty. Apply the exit criterion for each column and treat doubtful cards as Owned with an investigation action.

   Timing: 10–20 minutes

3. 3

   Commit

   Add ownership and review dates

   

   Goal

   Make open risks actionable with owners, actions, acceptance authority, and the next review.

   Inputs for this step

   • ROAM board
   • Responsibilities
   • Review cadence and escalation path

   Actions

   • Owned receives an owner, next action, and due or review date.
   • Mitigated receives a treatment, expected reduction, and evidence of effect.
   • Accepted receives rationale, risk acceptor, and reconsideration trigger.

   Output

   Actionable board

   Owner · action · date · evidence · acceptance

   Quality check

   Can every open card be actively tracked to the next review? Is acceptance documented by an authorised person?

   Pitfall

   Owned cards contain a name but no next action; Accepted becomes a parking place for uncomfortable risks. Complete status-specific fields and escalate unauthorised acceptance.

   Timing: 10–15 minutes

4. 4

   Review

   Update status from evidence

   

   Goal

   Review risks regularly, justify transitions, and close completed cards traceably.

   Inputs for this step

   • Current ROAM board
   • New evidence and treatment results
   • Changed objectives or dependencies

   Actions

   • Review Owned and Mitigated cards first.
   • Record every transition with date, rationale, and evidence.
   • Add new risks and archive rather than delete Resolved cards.

   Output

   Versioned risk picture

   Status history · new evidence · escalations

   Quality check

   Does every status change have a clear trigger? Are overdue Owned risks visibly escalated?

   Pitfall

   The board remains unchanged after planning and months later only reflects the original discussion. Establish a review cadence with an owner and escalate overdue cards.

   Timing: 10–20 minutes per review