Risk-Based Review¶

An attention-allocation method — instantiates Oversight Span Calibration

Grades every item by risk and spends review intensity in proportion, so scarce oversight attention concentrates where failure would cost the most.

Risk-Based Review breaks the reflex that every item deserves equal scrutiny. Its defining move is to grade each item on the drivers of consequence — impact, novelty, reversibility, and failure history — and then dial review depth to the grade, rather than to route items into fixed lanes or to wait for a deviation. A low-risk, routine, reversible item gets a light touch; a high-risk, novel, irreversible one gets deep review. The result is that the same finite oversight capacity buys far more protection, because attention is proportional to what is actually at stake instead of spread evenly across a queue in which most items barely matter.

Example¶

A city's food-safety program cannot inspect every one of its 3,000 permitted establishments equally often on a fixed roster. So it grades them: a high-volume restaurant doing raw-protein prep with a history of violations scores high; a pre-packaged-snack kiosk with a clean record scores low. Risk-based review then sets inspection intensity to the grade — the high-risk kitchen is visited perhaps three times a year with a full audit, the low-risk kiosk once with a short checklist. The same inspector-hours now cover the city, but concentrated where an outbreak is plausible rather than smeared uniformly across sites that could not poison anyone if they tried.^[1]

The grades are not permanent: a clean high-risk kitchen can earn a lighter cadence, and a low-risk site that fails once is re-graded upward. What the method produces is a defensible allocation — "this establishment class warrants this much scrutiny" — that a tiered protocol can then route and a schedule can then staff.

How it works¶

Choose the risk drivers. Decide which factors move an item's grade — impact if it fails, novelty, reversibility, interdependence, and history of past failure.
Grade every item. Score each item or item-class on those drivers into a small number of risk bands.
Set intensity to the grade. Map each band to a review depth and cadence — checklist vs. full audit, annual vs. quarterly — so effort tracks stakes.
Re-grade on evidence. Move items between bands as history accumulates; a clean record lightens, a failure sharpens.

Tuning parameters¶

Risk drivers and weights — which factors enter the grade and how heavily. Overweighting a visible-but-minor driver aims attention at the wrong things.
Number of bands — two bands are simple but coarse; many bands are precise but costly to grade and easy to game.
Intensity spread — how different the lightest and heaviest reviews are. A wide spread frees the most capacity but risks under-reviewing a mis-graded item.
Re-grading responsiveness — how quickly a failure or clean streak moves an item's band. Fast response adapts but can whipsaw on noise.
Floor — the minimum review even the lowest-risk item gets, so "low risk" never becomes "no oversight."

When it helps, and when it misleads¶

Its strength is leverage: by concentrating scrutiny where consequences live, it turns a fixed pool of oversight into far more protection than uniform review could, and it gives a principled answer to "why did you spend more time on this one." It is the logic that makes a large span survivable at all.

Its danger is that the grade is only as good as its model of risk. Familiar, easily-scored risks crowd out novel ones that have no history yet, so the method is structurally blind to the unprecedented — precisely the failures that hurt most. A low grade can quietly become no oversight when the floor is missing. And the classic misuse is to run the scoring backwards — assigning a low risk grade to an item someone wants left unexamined, so "risk-based" becomes cover for not looking. The discipline is to keep a mandatory review floor, to sample low-risk items to test the grading itself, and to treat novelty as a risk driver in its own right rather than scoring only what has failed before.

How it implements the components¶

Risk-Based Review fills the grade-and-size slice of the archetype — classifying items by risk and translating that into how much attention each warrants:

complexity_classification — its core: an ex-ante grading of items into risk bands by impact, novelty, reversibility, and failure history, separating the routine from the consequential.
oversight_load_metric — it converts each grade into a review-effort demand, so the classification directly measures how much oversight capacity a class of items consumes.

It grades and sizes but does not protect the attention freed up — the default-ignore-the-routine logic is Management by Exception — nor route graded items through fixed review levels, which is Tiered Review Protocol.

Instantiates: Oversight Span Calibration — this method is the principle that makes a wide span defensible by spending scrutiny where it counts.
Sibling mechanisms: Tiered Review Protocol · Management by Exception · Supervision Ratio Model · Sample Audit Review · Caseload Cap · Span-of-Control Design · Delegation Framework · Escalation System · Lead or Deputy Role · Management Layer Design · Oversight Dashboard

Notes¶

Risk-Based Review is the grading logic; Tiered Review Protocol is a common way to operationalize it into discrete lanes. You can grade risk without formal tiers (variable inspection depth), and you can run tiers off a non-risk criterion, but the two are frequently paired — the review reads the grade the review method produces.

References¶

[1] Risk-based inspection / risk-based supervision is an established regulatory practice in food safety, banking, aviation, and environmental enforcement: inspection frequency and depth are set by an establishment's risk profile rather than a uniform calendar, precisely so that finite inspector capacity is spent where harm is most likely. ↩