Risk descriptions need a causal mechanism

A risk label identifies a subject. A risk mechanism explains how an objective could fail. The difference is easiest to see in a register entry such as operational disruption. That phrase may encompass an unavailable utility, a maintenance omission, an equipment fault, a data error, an unsafe instruction or a contractual interruption. The control that addresses one of those routes may have little effect on another. Without an explicit causal path, a mitigation column can collect reassuring activities while leaving the relevant failure mechanism unchanged.

A useful mechanism record begins with the objective and the asset or capability on which it depends. It then identifies a condition that can enable an event, the event that crosses a meaningful boundary and the consequence that matters to the decision. In the dispatch illustration, the objective is continuous provision of the stipulated service, the enabling condition is uncertain operating support for a safeguard, the event is inability to continue dispatch and the consequence is the specified contribution loss. Each term belongs to the same scope. None is a claim that a real facility has this failure rate or loss amount.

The event definition matters because probability cannot attach to an undefined occurrence. An analyst who estimates the chance of equipment failure and then applies the severity of an entire site shutdown has combined different objects unless the mapping is justified. Some failures may not interrupt service; some interruptions may have several causes. A register should identify whether the supplied probability concerns the initiating condition, the top event or the final loss. The canonical demonstrator takes an annual probability for the stated gross event before its supplied controls. It does not infer the transition from every conceivable initiating cause.

The boundary between prevention and mitigation also needs a causal meaning. Prevention changes the chance that the top event occurs when the control is available. Mitigation changes the loss severity if that event occurs in the available-control state. A second activity may support both functions, but its operating dependency should not disappear from the model merely because the register gives the activities different names. In the recurring illustration, the same support state governs both. This deliberately tests the temptation to credit nominally separate safeguards as though they continuously and independently operated.

The causal description is a hypothesis to challenge. Suppose the operating team says a training programme prevents dispatch interruption, while the top event in the record is loss of external power. Training might support a safe shutdown or quicker response, but it may not prevent the initiating power loss. The analyst should trace the actual path rather than place training in the prevention column by habit. The proposed classification changes which evidence matters: an electrical supply test could inform one link, while a response exercise could inform another. Neither alone proves the complete protective chain.

A mechanism can also reveal a missing branch. A safeguard may depend on telemetry, personnel access, spare parts and an approved procedure. If any required condition fails, the nominal protective effect may be unavailable. A single availability parameter compresses those operating dependencies into an authored conditional state; it does not estimate each dependency or identify which one fails in reality. The record must retain that compression so a practitioner knows what further evidence to request. More detail is warranted when the decision depends on a particular dependency, rather than because a detailed diagram appears more credible.

The distinction between description and proof is central. A supplier diagram can establish what the designer intends the control to do. A maintenance record can show that a task was performed. A test can show performance under its test conditions. An operating history can inform how often a control was available under observed conditions. These are different propositions. A statement that the control exists does not prove that it acts on the relevant mechanism or that it operates when needed. The assurance task is to identify which proposition the decision relies on and whether the available evidence supports it.

A causal record should also preserve competing explanations. If a service interruption is attributed entirely to safeguard availability, the analyst may miss changes in demand, process operation or loss measurement. A control can appear effective because the event was less severe for another reason. A new operating regime can change the baseline probability independently of the safeguard. A serious performance evaluation therefore needs a counterfactual or an appropriately bounded interpretation. The simple model here cannot resolve those causal-identification questions. It can expose the assumptions that a more complete evaluation would need to distinguish.

The diagram becomes useful when it helps reject an irrelevant response. The ineffective-control fixture deliberately supplies no conditional prevention or mitigation effect even though its shared availability is high. Its residual expected loss therefore remains at gross expected loss. Paying for that activity cannot be counted as protective value for this stated path. The conclusion is narrow: the activity has no supplied effect on the chosen mechanism. It does not establish that the activity lacks all organisational value, nor that a statutory or ethical obligation disappears. Another objective would require its own mechanism and evidence.

The paid ineffective fixture makes a useful adverse test for the evidence request. If the proposed activity cannot show a connection to this event or its consequence, a highly favourable availability assumption is insufficient. The institution should reject the claim of protective value for this mechanism and ask whether the activity is justified under another objective. That is a more discriminating result than lowering a general control-quality score, because it identifies what the evidence would have to establish to change the decision.

A completed challenge should identify the alternative interpretation and the resulting action. Here the Operating Owner claims the safeguard proposal changes protective performance. The Mechanism Analyst asks whether the activity changes event probability, event severity or the state in which those changes apply. The Evidence Custodian cannot provide actual supporting test records because the fiction contains none. The disposition is consequently a held protective claim with a bounded evidence mandate, not a conclusion that the real safeguard has failed. The numerical ineffective case shows what would follow if the claimed link were absent.

This controlled contrast also separates reliability from efficacy. Reliability describes whether the specified control package is available under the model's state definition. Efficacy describes what prevention and mitigation do when that package is available. An available irrelevant control can be ineffective; an effective design can be unavailable. A single maturity score can blur these distinctions because organisational maturity may mix documentation, staffing, testing and management attention. A mechanism-specific record should say which of those factors supports availability, which supports conditional effect and which is merely a governance precondition.

Causal precision prevents an attractive control from migrating between risks without justification. A response capability that limits the loss after a dispatch interruption does not automatically reduce the probability of a privacy breach. A monitoring service that identifies anomalies may support several decisions, but each benefit needs a defined path. The paper's cross-risk aggregation examples therefore preserve separate named events and loss claims. Shared infrastructure is a reason to examine dependencies, not permission to multiply a generic effectiveness percentage across an entire register.

The practical purpose is selective investigation. The institution rarely has enough time to prove every link in every register entry to the same depth. It should investigate the link whose uncertainty could change the next commitment. For the fictional dispatch decision, the disputed link is the evidence for shared availability under the proposed operating conditions. A more detailed cause catalogue would not close that issue. A narrowly designed test and a record of its limits could be more useful than broadening the register to include every conceivable hazard.