Why Put Risk Review at a Decision Gate?
A proposal can have a sound business case and still require changes before the organization commits funds, signs a contract, or exposes itself to a new risk. A decision gate is a defined point at which a proposal must be reviewed against specified evidence and authority requirements before it may proceed. It makes risk review part of the decision process, rather than a discussion that can be overlooked after the main decision has effectively been made.
Gates are particularly useful when a decision is difficult to reverse, creates a material exposure, or commits resources in stages. The review should take place early enough to influence the decision, and the gate should state what happens if information is missing, a limit is exceeded, or a required control is not ready. The aim is not to require the same review for every routine action. It is to ensure that proposals receive a proportionate review before crossing a meaningful commitment point.
A gate does not replace analysis of the proposal's risks, benefits, controls, or fit with risk appetite. It specifies how that analysis enters a decision and who can authorize the next step. The earlier material on strategic objectives, risk trade-offs, business cases, staged commitments, and risk appetite provides useful inputs; the gate makes their use operational.
Designing a Gate Before a Proposal Arrives
A gate should be designed around the decision it controls. For example, a gate before signing a long-term outsourcing agreement may need to cover the total committed cost, service disruption exposure, exit provisions, and readiness of fallback arrangements. A gate before the next funding tranche of a product launch may focus on evidence from the prior stage and whether the remaining exposure is within appetite.
At a minimum, define the following elements in advance. Thresholds and approval limits should be set by the organization; the values in the examples below are hypothetical, not general standards.
- Trigger: State which decisions require the gate. Triggers may include a commitment above a monetary threshold, entry into a new market, a material change in risk, a limit exception, or a transition from one project stage to another.
- Evidence: Specify the information needed to make the decision. This commonly includes the proposal and its alternatives, costs and benefits, key risk scenarios, relevant controls, fit with risk appetite, material uncertainties, and dependencies. Define the required level of detail in proportion to the decision.
- Approval authority: Identify the role or body authorized to approve within the relevant limits. A proposal outside that authority must be routed to a higher approval level; it cannot be treated as approved merely because a lower-level review is complete.
- Escalation route: State what requires escalation and where it goes. Examples include a risk-appetite exception, an exposure above delegated authority, disagreement about a material assessment, or a critical evidence gap that cannot be resolved at the current level.
- Decision outcomes: Define the possible outcomes and what each means in practice: proceed, proceed only after stated conditions are met, defer pending evidence or action, escalate, or stop.
This rule follows from the purpose of a gate: all required safeguards must hold at the point of commitment. If evidence is incomplete, the decision-maker cannot establish whether the criteria are satisfied. If a limit is breached, an approval from an authority without exception power does not cure the breach. Treating these requirements as a conjunction prevents a strong benefit estimate from compensating for a failed mandatory control or an unauthorized exception.
A Practical Sequence for Gate Reviews
Identify the commitment being considered, its full scope, and the reason it falls within the gate. Include linked phases or contractual obligations rather than looking only at the next payment.
Confirm that required analyses, assumptions, controls, and approvals are present. Mark unresolved items as gaps rather than silently treating them as favorable findings.
Compare the proposal with the stated appetite and approval thresholds. Determine whether a standard approval is sufficient or whether an exception or higher-level approval is required.
State what is approved, what remains prohibited, the evidence or action required to satisfy each condition, and who or what confirms completion.
Require a new review if the proposal changes materially, a condition is not met, or new information moves the exposure outside the approved basis.
Worked Examples
Worked Example: Routing a Staged Product Commitment
A hypothetical insurer proposes a product launch with three planned funding tranches of $9 million, $7 million, and $5 million. Its internal gate requires executive risk committee approval for total commitments above $15 million. The launch may proceed under the standard risk criterion only if the estimated net stress loss is no more than $7 million. A proposed control is expected to reduce the stress loss by $1.6 million from the current estimate of $8.2 million. Determine the commitment amount, risk result, route, and a suitable gate outcome. Assume the control has not yet been tested.
Method. First calculate the full planned commitment; then apply the stated risk criterion only to the post-control estimate, while distinguishing an expected control benefit from a verified control result.
Step 1: Calculate the commitment. The total is \(9+7+5=\$21\) million. This exceeds the $15 million threshold by \(21-15=\$6\) million, so the proposal must go to the executive risk committee.
Step 2: Calculate the estimated stress loss after the control. The projected amount is \(8.2-1.6=\$6.6\) million, which is \(7.0-6.6=\$0.4\) million below the criterion. However, the control is untested, so $6.6 million is a conditional estimate, not verified evidence that the criterion is met.
Step 3: Set the gate outcome. The committee may consider the full $21 million proposal, but the gate should not authorize unconditional launch on the untested estimate alone. A suitable outcome is conditional approval: authorize the first tranche only if the committee approves that scope, require a specified test demonstrating that the control is effective, and prohibit the next tranche until the test result is reviewed and the stress-loss criterion is confirmed. If testing fails to establish a result at or below $7 million, the proposal returns for redesign or a permitted exception.
Check. The commitment exceeds the delegated threshold, so the route is escalated. The estimated post-control loss is below the limit, but its key assumption is unverified, so a condition is needed before further commitment. The common mistake is to treat the projected $6.6 million as established fact and approve all tranches immediately.
Worked Example: Applying a Gate to a Long-Term Agreement
A hypothetical insurer is considering a five-year service agreement with an upfront implementation fee of $1.8 million, annual fees of $1.1 million, and a $0.7 million exit charge if it terminates early. Its approval policy requires the investment committee to review total contractual commitment above $7 million. The stress scenario estimates a $4.6 million net loss from a service interruption; the gate criterion is no more than $4 million. A tested fallback arrangement is expected to reduce that stress loss by $0.9 million. Determine the commitment, approval route, and decision conditions.
Method. Sum the fees across the full term and include the possible exit charge in the commitment assessment; then compare the controlled stress estimate with the stated criterion.
Step 1: Calculate the scheduled fees. Five annual fees total \(5 \times \$1.1=\$5.5\) million. Adding the implementation fee gives \(\$5.5+\$1.8=\$7.3\) million.
Step 2: Include the exit charge. The maximum stated contractual amount, including the exit charge, is \(\$7.3+\$0.7=\$8.0\) million. This is $1.0 million above the $7 million threshold, so investment committee review is required. The $0.7 million charge is contingent, but it is still a material obligation relevant to the gate.
Step 3: Apply the stress criterion. The fallback reduces the estimated net stress loss to \(4.6-0.9=\$3.7\) million. This is \(\$4.0-\$3.7=\$0.3\) million below the criterion. Because the fallback has been tested, the evidence is stronger than an untested projection; the gate package should still include the test result and specify that the arrangement remains available and operational.
Step 4: State the decision. Route the agreement to the investment committee. The committee could approve it subject to confirming the tested fallback is included in the operating arrangements, reviewing the complete contract including termination terms, and prohibiting execution until those conditions are satisfied.
Check. The maximum stated contractual amount is $8.0 million and the controlled stress estimate is $3.7 million. The common mistake is to count only the $1.8 million upfront fee or the $5.5 million annual fees, which understates the commitment and could send the proposal to the wrong approval level.
Worked Example: Deferring a Proposal With an Evidence Gap
A hypothetical technology project requires a $3.6 million implementation payment and four annual support payments of $0.8 million each. A business-unit approval limit is $7 million. The gate requires a documented recovery test before production use, and the risk criterion is a maximum $2.5 million loss in the specified disruption scenario. The current estimate is $2.2 million, but it assumes recovery within one day; no recovery test has been completed. Determine the total commitment and the appropriate outcome.
Method. Calculate the full commitment, check the authority limit, and separately test whether the required evidence and risk criterion have been established. A favorable estimate based on an unverified assumption does not complete the gate.
Step 1: Calculate total commitment. Support payments total \(4 \times \$0.8=\$3.2\) million. Adding implementation gives \(\$3.6+\$3.2=\$6.8\) million. This is \(\$7.0-\$6.8=\$0.2\) million below the business-unit limit, so the amount alone does not require escalation under the stated policy.
Step 2: Check the risk evidence. The estimated $2.2 million loss is below the $2.5 million criterion by $0.3 million. However, that estimate depends on one-day recovery, and the required recovery test has not occurred. The gate's evidence requirement is therefore incomplete; the estimate cannot establish that the risk criterion is met.
Step 3: Choose the outcome. Defer production authorization until the recovery test is completed and the disruption estimate is updated using its result. If the updated estimate is no more than $2.5 million and the test meets the required standard, the proposal may return for approval within the business-unit limit. If it exceeds $2.5 million, the proposal must be mitigated, redesigned, or escalated through the applicable exception route.
Check. The $6.8 million total is within the stated amount limit, but the proposal still fails the evidence-completeness test. The common mistake is to approve because $2.2 million is numerically below $2.5 million while ignoring that the required test has not been performed.
Making Conditions Enforceable
“Proceed subject to satisfactory risk management” is not a useful condition. It does not say what must happen, how success will be judged, or whether commitment is allowed before completion. A gate record should instead make each condition observable and attach it to a decision boundary. For example, “do not release the second funding tranche until the specified recovery test is completed, its results meet the approved standard, and the committee has reviewed the evidence” identifies an action, a criterion, and the point at which approval is needed.
A decision record should also identify the approved scope and assumptions. If the proposal later changes in a way that affects cost, exposure, controls, or timing, the existing approval may no longer apply. Define in advance which changes require the proposal to return to the gate. This prevents a narrow approval from being interpreted as permission for a materially different commitment.
| Gate outcome | Meaning | What happens next |
|---|---|---|
| Proceed | Required evidence, criteria, and authority requirements are satisfied. | Proceed within the scope and assumptions recorded in the decision. |
| Proceed with conditions | Approval is given for a defined scope, with specified prerequisites or limits. | Do not cross the stated commitment boundary until conditions are confirmed. |
| Defer | A necessary decision input or action is incomplete. | Complete the stated work and return for review; do not treat silence as approval. |
| Escalate | The proposal exceeds current authority, needs an exception, or raises an unresolved material issue. | Send it to the designated higher authority with the issue and evidence clearly stated. |
| Stop | The proposal is unacceptable under the applicable criteria, or cannot be made acceptable. | Do not proceed unless a materially revised proposal is submitted through the gate. |
Common Gate-Design Traps
- Using only the next payment to set the approval route. Assess the full commitment and relevant contingent obligations, not merely the immediate cash outlay.
- Allowing benefits to offset a failed mandatory criterion. A favorable business case does not itself authorize an appetite breach or waive a required control.
- Using an informal escalation path. The route should be clear before a problem arises, including who can authorize an exception and what evidence must accompany it.
- Calling an unresolved question a condition without defining it. State a verifiable action, an acceptance criterion, and the point before which commitment is prohibited.
- Approving a proposal without defining its scope. Record material assumptions and specify when a changed proposal must return for review.
Check Your Understanding
For each hypothetical situation, determine the commitment or risk result, then identify the appropriate gate outcome from the information given.
- A proposal has a $2.4 million setup cost and annual fees of $0.55 million for five years. The approval threshold is $5 million. What is the scheduled commitment, and does it cross the threshold? (Answer: $5.15 million; yes, it exceeds the threshold by $0.15 million and requires escalation.)
- A project has a stress-loss estimate of $6.3 million against a $5.8 million criterion. A specified control is estimated to reduce loss by $0.7 million, but it has not been tested. What is the estimated controlled loss, and can the gate treat the criterion as verified? (Answer: $5.6 million, which is $0.2 million below the criterion; no, the untested control leaves the result unverified, so require evidence or defer further commitment.)
- A contract includes $2.2 million upfront, three annual payments of $1.4 million, and a possible $0.5 million termination charge. The review threshold is $7 million. A tested continuity plan reduces a $4.8 million stress loss by $1.1 million, against a $4 million criterion. What amount should be considered for threshold routing, and what is the controlled stress result? (Answer: $6.9 million including the stated termination charge, so it does not exceed the $7 million threshold; controlled stress loss is $3.7 million, $0.3 million below the criterion.)
- A proposal's full commitment is $8.4 million, while the current approval limit is $8 million. Its evidence package is complete and its risk criteria are met. What remains necessary before it may proceed? (Answer: Escalation to an authority that can approve the $8.4 million commitment; meeting risk criteria does not remove the authority limit.)
- A staged initiative requires $4 million now and $3 million after a pilot. The gate permits the first stage but requires pilot evidence before the second. The pilot is incomplete, although the sponsor forecasts that the second stage will meet appetite. What can be authorized now? (Answer: Only the first $4 million stage, if within the applicable authority; defer the $3 million stage until the pilot evidence is reviewed at the gate.)