VERSION 2.0 • PUBLIC WORKING DRAFT • AUGUST 2026
Can Your Risk Assessment Support the Decision You Are About to Make?
A risk assessment may be technically competent and still fail to support the reliance placed upon it.
The Case for Defensible Risk Assessment examines the governance question that arises after an assessment has been completed: What reliance, if any, can this assessment reasonably support for this particular purpose?
PDF • Version 2.0 • August 2026
Document Version
Version 2.0
Publication Status
Public Working Draft
Release Date
August 2026
Foreword Contributor
Rachel V. Rose, JD, MBA
The Governance Challenge
The Gap Between Technical Execution and Decision Reliance
Established methodologies such as NIST, ISO, FAIR, COSO, OCTAVE, HITRUST, and sector-specific approaches provide disciplined ways to conduct risk assessments. But the use of a recognized methodology does not, by itself, establish that a completed assessment can support every subsequent decision.
Consider the Spectrum of Reliance:
An assessment prepared for internal prioritization may not be sufficient for an acquisition, board decision, regulatory representation, insurance submission, public disclosure, or acceptance of material residual risk.
The issue is not simply whether the organization conducted a risk assessment—or even whether it conducted the assessment competently. The additional governance question is whether the completed work can carry the particular weight the organization intends to place upon it.
Framework Boundaries
What Defensible Risk Assessment Is—and Is Not
DRA acts as an evaluation discipline and governance layer without replacing existing methodology standards.
DRA Proposes
Defensible Risk Assessment is a proposed evaluation discipline and governance layer for determining what reliance a completed risk assessment and its supporting record can reasonably support for a stated purpose.
It applies common criteria to the completed assessment, its evidence and limitations, and the decision context in which it will be used.
Focus: Governance evaluation of completed risk work product.
DRA Does Not
- Replace the organization’s chosen risk-assessment methodology.
- Prescribe one universal method for assessing risk.
- Replace executive or board judgment.
- Produce an audit opinion, certification, or legal conclusion.
- Guarantee that the resulting decision or outcome will be correct.
Clear boundaries avoid unsupported novelty claims.
Evaluative Yardstick
The Eight Criteria Domains
The proposed DRA framework evaluates a completed assessment through eight structured Criteria Domains:
1. Purpose and Decision Context
Evaluates whether the explicit purpose of the assessment matches the actual decision or reliance context (e.g. M&A, regulatory representation, insurance filing vs internal prioritization).
2. Scope and Completeness
Checks if boundaries, assets, systems, threats, and operational environments are comprehensively defined without critical blind spots.
3. Method and Competence
Assesses whether the applied methodology was executed competently and fits the specific nature of the evaluated risks.
4. Evidence Quality and Provenance
Examines the authenticity, recency, relevance, and verifiable integrity of supporting records, logs, and interview evidence.
5. Assumptions and Uncertainty
Explicitly identifies key assumptions, confidence levels, data gaps, and potential margin of error in risk severity and likelihood findings.
6. Traceability and Reproducibility
Ensures that independent evaluators can trace conclusions back to foundational evidence and reproduce the reasoning path.
7. Limitations and Alternatives
Clearly articulates what the assessment does NOT cover, along with alternative interpretations or counter-analyses considered.
8. Governance, Independence, and Record Integrity
Verifies objectivity, freedom from undue conflict or pressure, and the tamper-evident retention of final assessment records.
Click any domain above to expand detail on its evaluation criteria.
Why Publish a Working Draft?
This paper is being circulated as a public working draft to invite discussion, test its central proposition, identify relevant existing practices, and assess interest in further developing Defensible Risk Assessment.
It does not establish a professional standard or prescribe a particular risk-assessment methodology. Comments, challenges, counterexamples, and expressions of interest are welcome.
Foreword Attribution
Foreword by Rachel V. Rose, JD, MBA
The paper includes a Foreword by Rachel V. Rose addressing the importance of evidence, governance, accountability, and reasonable reliance in consequential risk decisions.
Rachel independently authored the Foreword. Responsibility for the paper’s analysis, proposed framework, and conclusions remains with Bob Chaput.
Download the Public Working Draft
Download the complete paper, including Rachel Rose’s Foreword, the proposed DRA contribution, a composite acquisition scenario, the eight Criteria Domains, a research glossary, and supporting endnotes.
SUGGESTED CITATION
Chaput, Bob. The Case for Defensible Risk Assessment. Version 2.0, Public Working Draft. August 2026. Foreword by Rachel V. Rose. Available at https://staging11.weblychee-dev.com/defensible-risk-assessment/.
Interested in Providing Feedback on
the case for defensible risk assessment (DRA)?
Please complete this request form below, and I will respond with a copy of version 2.0 - Public Working Draft - August 2026 for your review.