vaayaa Inclusive Education
Professional risk assessment

Information Technology and Digital Consulting Risk Assessment: Delivery, Data and Supplier Controls

A worked example of how a digital consulting practice finds, scores and controls the risks that threaten client systems, data, fees and reputation, from unclear ownership and handover gaps to outages and supplier dependency.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Information Technology and Digital Consulting course

Executive summary

This assessment shows how a small digital consulting practice can find, rate and control the risks that matter most to client systems, data and fees. Eight risks were chosen because they arise in everyday discovery, build, handover and support work. Ownership gaps, outages and supplier dependency carry the highest natural scores, while billing leakage and data protection breaches are more contained once controls are in place. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low, but supplier dependency and data loss stay at Medium because client impact remains serious. The first actions are named ownership for every corrective action, a tested handover checklist, a backup restore test and a monthly check of time and billing. The practice is a teaching example, so every score illustrates method, not a real organization.

Focus area
Information technology and digital consulting
Setting
Advisory practice delivering digital transformation, systems integration and IT support to client organizations
Method
Five by five likelihood and impact risk register

Scope

This assessment covers a small digital consulting practice that designs, builds and supports information systems for client organizations, from discovery and design through delivery, handover and ongoing support. It looks at risks to client outcomes, data, fees, legal duties and the practice's reputation. It does not give legal, security or licensed technical advice for any real client. Jurisdiction, client sector, cloud platforms and team size are assumptions made for teaching.

Context

The practice has a delivery director, a set of project leads, consultants who work across discovery, design and build, two engineers who run hosted environments, a finance administrator who raises invoices from timesheets, and a service desk for client support. Most client systems run on third party cloud platforms and software as a service tools. Engagements use shared document stores, ticketing tools and time recording. Each risk is scored before controls to show its natural level, then again after the existing controls and the controls that should be added.

Objectives, assets and stakeholders

The objective is to deliver client systems that work, protect client data, bill accurately, meet contract and legal duties, and keep client trust. Assets in scope include client data and configurations, source code and documentation, cloud accounts and hosted environments, time and billing records, and the practice's reputation. Stakeholders include consultants and engineers, the delivery director, clients and their users, third party platform suppliers, finance staff and the regulators that apply to client data. Every risk has one owner role, and the delivery director keeps the register current and reviews it with the leadership group each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H02 H05 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H04
3 Possible Likelihood 3, impact 3, score 9, medium: H07 H08 Likelihood 3, impact 4, score 12, high: H06 Likelihood 3, impact 5, score 15, high: H03
2 Unlikely
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H05 H07 H08 Likelihood 2, impact 3, score 6, medium: H01 H02 H06 Likelihood 2, impact 4, score 8, medium: H03 H04
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Unclear ownership and failed corrective action 16 High 6 Medium Delivery director
H02 Handover failure and loss of key knowledge 12 High 6 Medium Engineering lead
H03 Third party platform and supplier dependency 15 High 8 Medium Supplier manager
H04 Technology outage and data loss 20 Critical 8 Medium Engineering lead
H05 Billing errors and financial leakage on engagements 12 High 4 Low Finance administrator
H06 Data protection and contract breach 12 High 6 Medium Data protection lead
H07 Failed deliverable and reputational damage 9 Medium 4 Low Delivery director
H08 Capacity overload and scope creep 9 Medium 4 Low Delivery director
H01

Unclear ownership and failed corrective action

Operational Before 16 After 6

Client review findings and project actions have no single owner or due date, so agreed fixes are delayed, repeated or quietly dropped, and clients lose confidence in delivery.

Who or what is affected: Project leads, clients and the delivery director

Causes

Informal meeting notes, competing client demands and unclear role boundaries.

Consequences

Repeated defects, unhappy clients, disputed invoices and lost renewal work.

Existing controls

  • Actions are recorded in the project notes after each review.
  • The delivery director reviews open actions at the monthly meeting.

Control gaps

Actions do not always get a date, and the monthly review only looks at the top ten items.

Additional controls

  • Prevent: Require a named owner, role and due date before any action is accepted into a plan.
  • Detect: Run a weekly list of overdue actions and send it to each project lead.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Delivery director Target: Within 30 days Early warning: Corrective actions from client reviews open past their due date.
H02

Handover failure and loss of key knowledge

People Before 12 After 6

When consultants move between projects or leave, configurations, credentials and decisions are not passed on, so support teams work blind and errors reach the client.

Who or what is affected: Clients, support engineers and incoming consultants

Causes

Rapid staff moves, tight timelines and knowledge held in personal notes.

Consequences

Outages that take longer to fix, repeated mistakes and client complaints.

Existing controls

  • Project leads write a short summary at the end of each phase.
  • Shared access to the document store is removed when staff leave.

Control gaps

The phase summary is optional, so most handovers still rely on memory.

Additional controls

  • Prevent: Use a handover checklist that must be signed before access is removed or the final invoice is raised.
  • Recover: Keep a register of undocumented configurations and assign each item to a named engineer.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Engineering lead Target: Within 45 days Early warning: Projects closed without a signed handover checklist.
H03

Third party platform and supplier dependency

Supplier Before 15 After 8

A cloud host, software vendor or subcontractor fails, changes terms or raises prices, so client services stop or cost more than the contract allows.

Who or what is affected: Clients, the delivery team and the finance function

Causes

Single vendor choices, long contracts and reliance on one hosting region.

Consequences

Service loss for clients, emergency migration costs and breach of service levels.

Existing controls

  • Main platforms are chosen from vendors with published service terms.
  • Supplier invoices are checked against the contract each month.

Control gaps

Exit steps are written for few platforms and have never been rehearsed.

Additional controls

  • Prevent: Record a second supplier option and exit steps for each critical platform in the client file.
  • Detect: Subscribe to vendor status notices and log each change to terms or pricing.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Supplier manager Target: Within 60 days Early warning: A critical vendor announces a price or term change without the agreed notice period.
H04

Technology outage and data loss

Technology and data Before 20 After 8

A failed deployment, hosting fault, ransomware or accidental deletion takes a client system offline or removes data that cannot be recovered on time.

Who or what is affected: Clients, end users and the engineering team

Causes

Manual changes, aging hosting configurations and admin rights held too widely.

Consequences

Client downtime, lost data, service credits and damaged trust.

Existing controls

  • Environments are backed up each night to a separate location.
  • Changes are made in a test environment before release to clients.

Control gaps

Restore tests cover only one environment, and rollback steps are not written down.

Additional controls

  • Prevent: Require peer review and written rollback steps for every production change.
  • Recover: Test restoring each client environment from backup at least twice a year and record the time taken.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Engineering lead Target: Within 30 days Early warning: Backup jobs that fail, or that have not been test restored within the last six months.
H05

Billing errors and financial leakage on engagements

Financial Before 12 After 4

Hours are logged wrongly, unapproved work is billed or approved work is not billed, and change requests are absorbed without recorded approval, so revenue leaks or clients are overcharged.

Who or what is affected: Finance team, clients and consultants

Causes

Late timesheets, unclear scope boundaries and informal requests from clients.

Consequences

Lost income, disputed invoices and damaged client relationships.

Existing controls

  • Timesheets are approved weekly by the project lead.
  • Invoices are raised from a template that lists the agreed rate card.

Control gaps

Write offs are approved by the same person who records the hours.

Additional controls

  • Detect: Compare timesheets with invoices each month and review all write offs.
  • Prevent: Require a signed change request before any work outside the agreed scope is logged to billing.
Likelihood 4 x impact 3 before; 2 x 2 after Owner: Finance administrator Target: Within 45 days Early warning: Invoices that differ from approved timesheets beyond the agreed tolerance.
H06

Data protection and contract breach

Legal and compliance Before 12 After 6

Client personal or commercial data is copied to unapproved storage, shared with the wrong party or kept beyond the period in the contract, breaking data handling duties.

Who or what is affected: Clients, end users and the practice

Causes

Copies made for convenience, unclear retention rules and staff unfamiliar with contract terms.

Consequences

Contract penalties, notification duties, legal claims and loss of client trust.

Existing controls

  • Data handling rules are set out in each client contract.
  • Access to client folders is limited to the named project team.

Control gaps

Retention periods are not tracked per client, so data is kept past its agreed end.

Additional controls

  • Prevent: Store client data only in approved locations and block personal file sharing for project folders.
  • Respond: Follow a written incident route that informs the client and the data protection lead within the contract time.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Data protection lead Target: Within 60 days Early warning: Client data copies held outside approved storage locations.
H07

Failed deliverable and reputational damage

Reputational Before 9 After 4

A system goes live with defects or misses the agreed benefits, and the client lays blame on the practice, damaging referrals and future work.

Who or what is affected: Clients, project sponsors and the practice's future work

Causes

Unclear success measures, late changes and optimistic promises made in bids.

Consequences

Lost referrals, fee disputes and reputational harm within the client's sector.

Existing controls

  • Acceptance tests are agreed with the client before build starts.
  • A sponsor sign off is required at each milestone.

Control gaps

Benefits are not tracked after go live, so shortfalls go unreported.

Additional controls

  • Detect: Run a short readiness review before each go live and record open defects with their owners.
  • Respond: Hold a client briefing within two working days of any incident to agree the facts and next steps.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Delivery director Target: Within 60 days Early warning: Milestones signed off while open defects remain above the agreed limit.
H08

Capacity overload and scope creep

Strategic Before 9 After 4

Too many live projects, unplanned extras and bids priced without capacity checks push teams beyond their planned hours, so quality drops and deadlines slip.

Who or what is affected: Consultants, project leads and clients

Causes

Optimistic bids, parallel projects and pressure to say yes to clients.

Consequences

Burnout, errors, missed deadlines and lost client trust.

Existing controls

  • Resource plans are updated monthly by the delivery director.
  • Bids are reviewed by a senior consultant before submission.

Control gaps

Plans count committed hours but not support and interruption time.

Additional controls

  • Prevent: Check team capacity against the bid plan and decline work that would push teams beyond the set limit.
  • Detect: Review weekly hours logged against plan and flag any team that runs over for two weeks.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Delivery director Target: Within 90 days Early warning: Teams logging more than the planned hours for two weeks running.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score guides the order of work and is not a precise measurement. Inherent risk is the score before any controls are applied. Residual risk is the score after existing and added controls, and it can never be higher than the inherent score. Impact considers client harm, data exposure, money lost, time to recover and damage to trust, and a risk is never rated down only because it has not happened yet. Critical and High risks need senior attention and a dated plan, Medium risks need routine controls with a named owner, and Low risks are accepted and watched. Ratings are challenged in a short review where the people doing the work explain the evidence, a second reviewer tests the scores, and any change is recorded with its reason. Ratings are also revisited whenever an early warning indicator reaches its threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Corrective actions from client reviews open past their due date.Escalate to the delivery director when any action is more than 14 days late, and to the leadership group after 30 days.
Projects closed without a signed handover checklist.Escalate to the delivery director at once, and hold the final invoice until the handover is signed off.
Platform or hosting service incidents lasting more than four hours.Escalate to the engineering lead on the first incident, and to the delivery director if a client is affected for more than one working day.
Invoices that differ from approved timesheets beyond the agreed tolerance.Escalate to the finance administrator for review within two days, and to the delivery director if the gap is not explained.
Client data copies held outside approved storage locations.Escalate to the data protection lead at once for containment, and to the delivery director within one working day.

Contingency arrangements

If a serious event occurs, such as a live client outage, confirmed data loss or a suspected breach of client data, the delivery director stops affected changes and informs the client through the agreed contact route. The engineer on duty isolates affected environments and restores data from the latest tested backup. Legal and security specialists are brought in to decide notification duties for the relevant jurisdiction. Client communication is plain and early, and the finance administrator pauses billing on affected work until the facts are clear.

Prioritized action plan

  1. Assign a named owner and due date to every corrective action from client reviews, owner delivery director, within 30 days.
  2. Test a restore of client environments from backup and record the time taken, owner engineering lead, within 30 days.
  3. Adopt a handover checklist for every project and require sign off before access is removed, owner project lead, within 45 days.
  4. Map critical third party platforms, document exit options and hold a yearly review, owner supplier manager, within 60 days.
  5. Compare timesheets with invoices each month and review write offs, owner finance administrator, within 45 days.

Conclusion

Reliable digital delivery depends on steady habits: named owners for every action, tested handovers, backups that are restored and checked, supplier exit plans, and accurate time and billing. The highest natural scores sit with ownership gaps, outages and supplier dependency, and each has actions that lower the residual score. Treat the register as a living record, review it on the stated cycle, and seek qualified legal, security and technical advice for any real client matter.

Assumptions and limitations

Assumptions

  • The practice works under written client contracts that set scope, service levels and data handling duties.
  • Staff are experienced consultants and engineers using managed laptops and approved cloud accounts.
  • Jurisdiction and client sectors are not specified, so legal duties are described in general terms only.

Limitations

  • The scores are examples for learning and do not describe any real practice or client.
  • Data protection, security and contract rules differ by location and change over time, so specialist review is needed.
  • This is educational content and is not legal, security or professional technical advice.

Related frameworks to study

  • Risk register with likelihood and impact scoring
  • Three lines model of risk ownership
  • Hierarchy of controls
  • Service continuity planning

Professional Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Information Technology and Digital Consulting course Read the best practices for this course

More Professional risk assessments

Hourly Active: 45,552 Learners