Connecting risk assessments to maintenance, capital planning, and asset management decisions.
Most utilities that dip their toe into the risk pool are more likely than not to have a risk register. Many have invested considerable time developing the criteria, assessing likelihood and consequences, and identifying their highest priority risks. Yet if they are asked a simple question, the answer may be difficult:
What decisions have changed because of what we’ve learned?
Maintenance backlogs are still prioritized using old, familiar criteria. Capital projects move through the same approval processes, established years ago. Replacement decisions are driven by condition, age, available funding, and sometimes the urgency of the latest failure. The risk assessment, at best, helps them understand their risk exposure better, but that understanding does not change how resources are allocated.
Risk registers can be useful for identifying, documenting, and communicating the risks they should worry about. The trouble starts when the organization expects the register to drive decisions when there is no process connecting it to where those decisions are being made.
In my experience, three recurring problems explain most of this disconnect.
1. Risks are identified without connecting them to decisions
Consider a utility that identifies aging infrastructure as one of its higher organizational risks. The concern is legitimate. Assets deteriorate, failure probabilities increase, and the consequences of failure can be substantial.
But what is the decision the organization must make? Replace the asset sooner? Inspect it more often? Maybe buy additional spares? Or should they shift funding from one asset to another? The register identifies the worry but is not giving decision makers what they need to evaluate each of these choices.
In my work, I see the same response to this gap again and again. A risk lands on the register, and a capital project is added to “remove” the risk. That thinking is a misunderstanding of what the asset risk is. For a long-lived asset, risk cannot be removed. Put in a shiny new transformer? It still has a probability of failure, and it still carries consequences if it fails. Replacement may change the exposure, but it does not eliminate it. The real job is to manage risk over the life of the asset, and a capital project is only one of the tools available.
Managing risk well requires a specific understanding of the assets involved, the credible failure modes, their likelihood and consequences, and the alternatives available to address them.
For example, two transformers can have similar condition assessments but very different consequences if they fail. One serves limited load with little service impact. The other serves critical customers and has redundancy for that reason. But with long replacement lead times, a single failure could leave the utility without its backup for months, exposed to an extended outage if the second unit fails. Condition is part of what informs the assessment, but it alone does not tell you which investment delivers more value. A useful risk assessment distinguishes between these situations and supports a comparison of different interventions.
The important question is what decision the risk information must influence.
Without that connection, the assessment improves awareness but leaves priorities unchanged.
2. Risk information enters the decision process too late
I’ve worked with many organizations where risk information arrives after alternatives are selected or budgets are set. They review risk during periodic workshops, quarterly reporting, or annual planning, when it has little influence. Asset management decisions, meanwhile, are made daily. Planners schedule work. Engineering evaluates repair and replacement alternatives. Operations plans outages. Finance reviews investment proposals. Leadership decides which projects proceed within available budgets. Each of these decisions involves uncertainty, consequences, and competing demands on resources.
Consider a maintenance backlog of several hundred work orders. A separate risk assessment flags a particular asset as having significant exposure. If the backlog is still prioritized by work order age, priority codes, or operational urgency, that information never reaches the schedule.
Capital planning has the same problem. An organization can recognize rising reliability risk across an asset class while continuing to rank projects with criteria that ignore the likelihood and consequences of failure.
A better assessment will not fix this. Risk information must be available when alternatives are developed, compared, and selected, and the criteria used to prioritize work and investment must reflect the organization’s objectives and tolerance for risk. That requires deliberate coordination between risk management and existing asset management processes.
3. Risk management operates separately from resource allocation
In most utilities, risk management, maintenance, reliability, engineering, and capital planning run through different processes, each with its own responsibilities, information, performance measures, and planning cycles. That structure often makes organizational sense. The problem comes when these processes apply different criteria to the same assets.
Return to the transformer serving critical customers. The risk assessment ranks it a high priority. Reliability ranks it lower because redundancy maintains service if one unit fails. Maintenance ranks it high, but only because of how its work orders are classified, not because of its actual risk. Capital planning defers replacement because the project scores poorly against other investment criteria.
Each group follows its process correctly. The organization still arrives at a decision that contradicts its own stated risk priorities.
Performance measures make this worse. Maintenance is judged on backlog completion, capital delivery on budget performance, and operations on availability. Each measure is useful on its own. Disconnected from broader objectives, they pull in different directions.
The organization needs consistent principles for evaluating the consequences, costs, and benefits of its choices: a shared understanding of risk appetite, agreed decision criteria, and clear accountability for decisions that cross organizational boundaries. The goal is to make risk information a routine input to resource allocation, backed by the right analysis and decision authority.
What does better integration look like?
Consider that same transformer. The utility sees rising failure probability and significant service consequences. The assessment establishes the exposure. The next step is to decide how to manage it.
The alternatives include:
- Continue operating with the existing maintenance strategy.
- Increase inspection or condition monitoring.
- Change the preventive maintenance strategy.
- Refurbish or replace selected components.
- Replace the transformer.
- Invest in spare equipment or other measures that reduce the consequences of failure
Each alternative carries a cost, an expected effect on risk, and implications for reliability, safety, service delivery, and future spending. The organization compares them using a consistent view of costs, risks, and expected outcomes over the planning period.
Notice that replacement is one option on this list, not the default answer. Even replacement does not remove the risk. The preferred alternative will not eliminate exposure, and it does not need to produce the lowest remaining risk. It must strike the right balance of value, performance, cost, and risk, consistent with the organization’s objectives and constraints.
That is the point where risk assessment starts to shape asset management decisions. The information supports a choice between feasible alternatives, informs where resources go, and helps decision makers explain the exposure they are accepting.
The same principles apply well beyond individual assets, to maintenance strategies, capital portfolios, inspection programs, spares decisions, and long-term investment planning.
A practical test for your organization
Select one of the highest priority risks in your register and work through five questions:
- What decisions must this risk influence? Identify the maintenance, operational, or investment choices associated with the exposure.
- What alternatives are available? Determine which interventions could reduce the likelihood or consequences of failure, and at what cost.
- How are these alternatives evaluated? Confirm whether the decision criteria reflect organizational objectives, risk appetite, and resource constraints.
- Who has authority to make the decision? Clarify responsibility for selecting an alternative, approving funding, or accepting the remaining exposure.
- What has changed because of the assessment? Identify whether the risk information has influenced a maintenance strategy, work priority, investment decision, or explicit acceptance of exposure.
You do not need to change every decision after a risk assessment. Sometimes the existing strategy remains the best option. What matters is that the risk information was considered, the alternatives were evaluated, and the resulting decision can be explained.
If these questions are hard to answer, you have found a gap between risk management and the processes you use to manage physical assets.
Moving from risk awareness to better decisions
Risk registers have a legitimate role in asset management. They give organizations a structured way to identify, communicate, monitor, and review uncertainty. Their value depends on what happens after a risk is identified.
Can the organization connect the exposure to specific assets and failure modes? Identify meaningful alternatives? Evaluate their expected costs and consequences? Use that information consistently when allocating limited resources? None of that comes from a well maintained register alone. It comes from integrating risk information into asset strategies, maintenance planning, capital investment, and operations.
Risk on a long-lived asset is never removed. It is managed, one decision at a time, for as long as the asset is in service.
The real measure of a risk register is how many of those decisions it shapes.
Asset Management System Integration (AMSI) works with utilities and public agencies to strengthen asset management capabilities, improve decision processes, and support sustainable infrastructure performance.
This article introduces a broader discussion on integrating risk management into asset management decision processes. AMSI is developing a white paper examining the practical mechanisms needed to connect risk assessments, organizational objectives, risk appetite, and resource allocation.
Want to talk about how your risk information connects to your decisions? Contact AMSI.