Why Better Risk Management Starts with a Common Language
How structured risk metalanguages can help organisations improve risk clarity, connect exposures across portfolios and make better-informed decisions.
By Oladapo Famuyiwa, BOF Consults · October 2026
The problem is not always a lack of risk information
Most organisations managing complex projects and programmes have risk registers, reporting dashboards, designated risk owners and established governance processes.
Yet a fundamental question remains: do these arrangements give leadership a connected view of risk, or simply a collection of concerns reported by different teams?
Consider a major infrastructure programme. One team records a risk as “delay in parts delivery”. Another identifies “supply chain disruption”. A third highlights a potential shortage of critical components.
They may be three separate risks. They may also be three descriptions of one underlying exposure — and in many portfolios, nobody can say which.
When risks are described and classified independently, organisations duplicate analysis, fragment their mitigation effort and miss the consequences of shared dependencies.
The problem is rarely the competence of individual risk owners. It lies in the way risk information is structured and communicated.
I have seen this at first hand. On a large-scale data centre project/programme in Europe, some technically oriented contributors recorded risks in narratives running to one or two pages. The narratives could contain useful technical detail, but the cause, the uncertain event, the consequence and the actions needed were difficult to pick out. The issue was not expertise; it was structure. I return to that experience, and to how we addressed it, in The Hidden Danger of the “Lazy Risk”.
At BOF Consults, we believe effective risk management must go beyond maintaining registers and reporting red, amber and green status. Organisations need a consistent way to describe uncertainty, understand relationships between exposures and translate risk information into better decisions.
One practical approach is risk metalanguage.
What is risk metalanguage?
A metalanguage is a structured language used to describe another language. In risk management, it provides a consistent way to describe, classify and connect risks through common concepts, definitions, attributes and relationships.
Dr David Hillson’s 2000 article, Project Risks: Identifying Causes, Risks, and Effects, published in PMI’s PM Network, sets out a structured approach for distinguishing the cause of a risk, the uncertain risk itself and its potential effects. Hillson subsequently developed this approach in his Risk Doctor briefings on risk identification and responses.
The underlying principle is straightforward: a risk description should distinguish what is already known, what might happen and what the consequences could be.
A useful formulation is:
Because of [cause], [uncertain event] may occur, which could lead to [effect on objectives].
This structure helps prevent existing conditions, uncertain events and possible consequences from being treated as interchangeable.
A broader risk metalanguage can also incorporate classifications, measurement methods, controls, ownership, assumptions, dependencies and relationships to objectives.
The aim is not to force every risk into identical wording regardless of context. It is to make risk information sufficiently consistent for meaningful analysis across teams and organisational boundaries.
Risk metalanguage does not replace the frameworks many organisations already use, such as ISO 31000, MoR or HM Treasury’s Orange Book. It gives their identification and reporting processes a more consistent vocabulary.
Start by describing risk properly
Consider a project dependent on topographical, utility and hydrographic surveys.
A register entry stating “Non-availability of surveys” identifies a concern but does not fully explain the uncertainty or its implications.
A more useful description would be:
Because the topographical, utility and hydrographic surveys have not yet been commissioned, they may not be completed before detailed design starts, which could prevent the engineering, procurement and construction (EPC) contractor from completing design and procurement as planned and delay the project schedule.
This statement separates the known condition (the surveys have not been commissioned) from the uncertain event (late completion) and its consequences (disrupted design and procurement, and schedule delay).
The team can now establish when the surveys can realistically be delivered, identify dependent activities, assess the schedule implications and determine suitable responses.
Possible interventions include expediting surveys, using existing records for preliminary design, agreeing minimum information requirements with the contractor and reviewing the integrated master schedule.
Better wording does not eliminate uncertainty. It creates a more reliable starting point for analysing and managing it.
Distinguish risks from causes, consequences and issues
The same discipline applies to familiar entries such as “project delay”, “budget overrun” or “lack of resources”. Each may be a useful short title, but it may describe a consequence, an existing condition or an issue that has already happened — and each of those needs a different response.
Our companion article, The Hidden Danger of the “Lazy Risk”, shows how to tell them apart and how to write decision-ready risk statements.
Connect individual risks through a common taxonomy
The greater opportunity emerges when risks are classified consistently across projects and programmes.
For example, the three entries in our opening example — delay in parts delivery, supply chain disruption and component shortage — could all be mapped to:
Supply chain risk → Logistics → Critical component availability
Their original descriptions, owners, circumstances and mitigation actions should remain available. The common classification provides an additional analytical view through which potential relationships can be identified.
Programme leaders can then investigate important questions:
- Are several projects dependent on the same supplier?
- Could a disruption affect multiple delivery milestones?
- Are different teams relying on the same mitigation?
- Is a common cause creating exposure across several workstreams?
- Would a coordinated intervention be more effective than separate local responses?
Similar principles apply to cybersecurity, financial services and public-sector transformation.
Phishing and credential theft may share an identity and access dimension. Interest rate changes and reduced lending margins may be connected through market exposure. Growing case backlogs and delayed decisions may share underlying service-processing constraints.
These are potential relationships to investigate, not proof that all similarly classified risks have identical causes or require the same treatment.
A common taxonomy should improve visibility without removing the context and judgement needed to assess each risk properly.
Integrate risk with controls, dependencies and value
Risk information becomes more useful when it is connected to the decisions it is intended to inform.
A register that records likelihood, impact and a mitigation action may provide a basic level of control. More complex delivery environments require a richer picture of uncertainty and the measures being used to manage it.
Useful information can include:
- Causes, uncertain events and consequences.
- Existing controls and additional treatment actions.
- Accountable owners, assessment methods and supporting evidence.
- Dependencies, assumptions and links to related risks.
- Proximity, velocity and duration where relevant.
- Connections to strategic objectives, benefits and disbenefits.
It is particularly important to distinguish controls from actions. A control is an existing measure intended to prevent, detect or reduce an undesirable outcome. An action is an intervention that must be undertaken to establish, improve or implement a response.
This distinction helps governance teams understand what protection is already in place and what work remains outstanding.
The framework should also accommodate opportunities, not just threats. Uncertainty can create the possibility of improved outcomes as well as adverse consequences. Understanding both sides supports more balanced decisions.
For programme and portfolio leaders, the objective is to connect uncertainty to delivery commitments, business change, expected benefits and organisational value.
Establish a foundation for better risk data and analytics
Different functions often use different tools, categories and assessment methods. Engineering, finance, commercial management, cybersecurity and operational teams may hold valuable risk information, but combining it can be difficult when definitions and relationships are inconsistent.
A structured metalanguage can provide a common reference model while preserving the specialist detail required by each function.
Relevant metadata may include risk source, owner, assessment date, likelihood and impact scales, measurement method, controls, evidence and links to objectives.
These structures can support more consistent reporting, improve traceability and help assurance teams understand how a risk was assessed.
Machine-readable formats and knowledge graphs may provide a foundation for more sophisticated analysis, including identifying related risks and mapping dependencies across datasets. Tools such as Power BI can help visualise the resulting information, subject to the quality and structure of the underlying data.
However, technology should follow the design of the information model. Automated classification and AI-assisted analysis do not guarantee accurate conclusions. Data quality, validation, human judgement and accountability remain essential.
Getting started
Organisations do not need to replace every risk process or buy a new platform. A staged approach works: agree the description structure and taxonomy; map existing registers to it, treating potential duplicates as candidates for review rather than merging them automatically; train risk owners and PMO teams using practical examples; configure existing tools to support the agreed definitions; and refine the framework through assurance reviews and lessons learned.
Keep it proportionate. A small project needs a simple structure; a complex portfolio needs cross-domain classifications, richer metadata and stronger systems integration.
Measure the effect, too. Set a baseline first, then track indicators such as the proportion of risks meeting the agreed description standard, confirmed duplicate entries, and significant cross-project dependencies identified and acted upon. Interpret the results with care: better visibility often increases recorded exposures at first, and fewer reported risks can signal under-reporting rather than success.
Our follow-up article, From Risk Registers to Portfolio Intelligence, sets out a fuller roadmap for PMOs and portfolio leaders.
From risk reporting to better organisational decisions
Risk management is most valuable when it helps leaders understand uncertainty, evaluate options and take proportionate action before problems undermine delivery.
A common risk metalanguage offers a practical way to strengthen that capability. It can clarify risk descriptions, reveal potential relationships between exposures, improve consistency and provide a foundation for more integrated reporting and analysis.
Success depends on more than terminology. It requires sound governance, reliable evidence, competent people, clear accountability and a willingness to act on what the analysis reveals.
For organisations managing complex portfolios, the question is not simply whether every project has a risk register. It is whether those registers collectively provide a coherent view of the uncertainties that matter most.
Better risk management starts when organisations stop treating risks as isolated entries and begin understanding them as connected influences on delivery, change, benefits and value.
BOF Consults helps organisations strengthen project and programme delivery, PMO and project controls, risk management, assurance and benefits realisation. If your registers are full but your portfolio view is not, get in touch to book a free 30-minute Initial Consultation and talk it through.
Read next: The Hidden Danger of the “Lazy Risk” · From Risk Registers to Portfolio Intelligence
About the author. Oladapo Famuyiwa leads BOF Consults. He is a P3M consultant with more than 22 years’ experience across defence, aerospace and space, nuclear, infrastructure and government programmes, and holds the PMI Risk Management Professional (PMI-RMP) and Management of Risk (MoR) certifications alongside PMP, MSP, PRINCE2 and Managing Benefits Practitioner.
Reference
Work with a Partner Focused on Value, Not Just Delivery
If you are responsible for significant investment, complex change, or professional development, BOF Consults is ready to support you.