Composite Risk Management: Meaning, Five-Step Process and Example

5 min

Aug 7, 2025

Composite risk management is a structured five-step method for identifying hazards, assessing their risks, selecting and implementing controls, and checking whether those controls work. It helps decision-makers consider the combined conditions surrounding an activity rather than treating each hazard as an isolated issue.

Organisations can apply this five-step approach to project work, operational changes, field activities and other decisions where several hazards need to be controlled together.

What Does Composite Risk Management Mean?

Composite risk management is a decision-making process, not simply a risk score. Its purpose is to help a responsible person understand what could go wrong, judge the likelihood and severity of each hazard, choose effective controls, decide whether the remaining exposure is acceptable, and monitor the activity as conditions change.

The word composite reflects a whole-activity view. A project task may involve people, equipment, systems, timing, suppliers and environmental conditions at the same time. Each hazard should still be assessed clearly; the team should not hide serious individual risks by averaging them into one reassuring number.

This meaning is unrelated to customer relationship management, which also uses the abbreviation CRM. Keeping the two concepts separate is essential when researching training, templates or professional guidance.

For a broader organisational overview, read LOTC’s guide to the risk management process, types of risk and professional training.

The Five Steps of Composite Risk Management

The five-step sequence is cyclical: supervision may reveal a new hazard or show that a control is ineffective, sending the team back to an earlier step.

Step	Decision question	Practical output
1. Identify hazards	What could cause harm, loss, delay or mission failure?	A clear list of hazards linked to the activity and its conditions.
2. Assess hazards to determine risk	How likely is each event, and how severe would its consequence be?	An initial risk level based on the organisation’s approved matrix.
3. Develop controls and make risk decisions	What will reduce likelihood or consequence, and who may accept the remaining risk?	Specific controls, an owner and an authorised decision on residual risk.
4. Implement controls	Are the controls resourced, assigned, communicated and in place before work begins?	Actions, responsibilities, deadlines, briefings and evidence of readiness.
5. Supervise and evaluate	Are the controls being followed, and are they actually effective?	Monitoring, corrective action, escalation and lessons for future activities.

How a Composite Risk Rating Works

A risk rating normally combines two judgements:

Likelihood: the probability or frequency of the hazardous event.
Severity: the scale of the potential consequence if it occurs.

The combination produces an initial risk level before additional controls. After controls are designed, the team reassesses the same hazard to establish the residual risk. The relevant decision-maker then accepts, rejects or escalates that residual exposure according to the organisation’s authority thresholds.

Risk matrices differ, so labels such as low, medium, high or extremely high should be taken from the organisation’s approved method. The important discipline is not the label itself; it is documenting the assumptions, controls, owner and decision behind it.

Composite Risk Management Example: A System Cutover

Consider a project team preparing to move a customer service platform to a new system during a weekend cutover. The activity is time-limited, involves several technical and operational dependencies, and could disrupt customers if it fails.

CRM step	Application to the cutover
Identify hazards	The team identifies service outage, incomplete data migration, failed integrations, staff fatigue and a delayed rollback decision.
Assess risk	A prolonged outage is judged possible and severe, producing a high initial risk under the company’s matrix. Data corruption is less likely but could have a critical consequence.
Develop controls and decide	Controls include a tested rollback plan, verified backups, a rehearsal in a production-like environment, go/no-go criteria, extra technical cover and a named executive authorised to accept the residual risk.
Implement controls	Owners confirm backup integrity, complete the rehearsal, brief the support team, open monitoring dashboards and record decision checkpoints before the cutover begins.
Supervise and evaluate	The team monitors error rates and customer access in real time. If the agreed threshold is crossed, the authorised lead triggers rollback. A post-cutover review tests whether the controls worked and captures lessons.

The controls may reduce the likelihood of a prolonged outage, but they do not make the consequence harmless. That is why the residual risk must be reassessed and consciously accepted rather than assumed to be zero. This method can sit within the project’s wider planning and risk-mitigation activities.

Composite Risk Management vs Project Risk Management

Composite risk management and project risk management share the same basic logic, but they are not identical.

Area	Composite risk management	Project risk management
Primary use	A structured decision for a specific activity or operation.	Managing uncertainty across the full project lifecycle.
Focus	Hazards, controls, residual exposure and risk acceptance.	Threats and opportunities affecting scope, schedule, cost, quality and objectives.
Typical output	Risk assessment, controls, decision authority and supervision plan.	Risk register, owners, response plans, reserves, reviews and reporting.
Time horizon	Often immediate or activity-specific.	Continuous from initiation to closure.

CRM can therefore strengthen a project risk framework without replacing it. A project may maintain a strategic risk register while using the five-step method for a hazardous site visit, equipment commissioning, system cutover or other high-consequence task.

When Is Composite Risk Management Most Useful?

Use the method when an activity has several interacting hazards and requires a clear decision before execution. It is particularly useful for:

operational changes and system deployments;
construction, maintenance or field activities;
supplier transitions and critical handovers;
events, travel or work in changing conditions;
tasks where residual risk must be accepted by a defined authority.

For routine low-risk work, the assessment can be brief. Higher uncertainty or consequence requires more evidence, stronger controls and a more senior risk decision.

Common Composite Risk Management Mistakes

Scoring risk without improving the decision: a coloured box is not a control plan.
Using vague controls: “be careful” is weaker than a specific action, owner and deadline.
Ignoring combined conditions: acceptable hazards can become serious when fatigue, time pressure or system dependency interact.
Skipping residual-risk approval: controls reduce exposure; they rarely eliminate it.
Treating supervision as an afterthought: controls must be observed and evaluated during the activity, not only documented beforehand.

Build Practical Risk Management Capability with LOTC

Effective risk decisions depend on more than a template. Professionals need to assess uncertainty, design proportionate controls, assign ownership and communicate residual exposure clearly.

LOTC supports these capabilities through the PMI Risk Management Professional (PMI-RMP) course and Project Risk Management and Compliance training. To discuss the most relevant programme for your role or organisation, contact LOTC on WhatsApp.

Like what you read? Share with others.

Keywords

Composite risk management meaning

In This Article