Composite risk management considers risks together across an activity, rather than treating each hazard or department in isolation. The term is associated with U.S. Army risk management and its approach to considering hazards from different sources when making decisions.
For a business, the useful lesson is to consider how risks connect, agree controls and responsibilities, and review the remaining exposure as work progresses. The worked example below is a business adaptation, rather than an official military assessment or scoring system.
What does composite risk management mean?
The U.S. Army's 2014 ATP 5-19 publication explains that an earlier process was renamed composite risk management and broadened across operations and activities. It also explains the adoption of the term “risk management” to align with joint terminology.
This history matters when interpreting older material: composite risk management is earlier terminology for the approach, rather than a separate extra stage to add to an assessment.
In practical business terms, “composite” draws attention to the whole activity: the people, equipment, systems, suppliers and decisions involved, including the ways one problem could affect another.
The five steps of the process
The U.S. Army Combat Readiness Center describes five risk management steps:
- Identify hazards.
- Assess hazards.
- Develop controls and make risk decisions.
- Implement controls.
- Supervise and evaluate.
For a business adaptation, use these as prompts to identify what could affect the objective, assess the exposure, choose and implement controls, then check their effectiveness. Keep decisions about remaining risk with people who have the appropriate authority.
The steps support a continuing cycle. A change in circumstances can require an earlier judgement to be revisited.
A worked composite risk assessment example
Imagine a small organisation moving its customer support team to new premises while keeping the service available. The objective is to complete the move without an unacceptable interruption to customers.
1. Identify connected risks
The move could be affected by delayed internet installation, unavailable staff, equipment damage or incomplete access arrangements. Consider their connections: an internet delay may prevent staff from using the customer system, while limited staffing could make a temporary workaround harder to operate.
Involve the service manager, IT support and the people organising the move. Check supplier dates and ask what assumptions remain unconfirmed.
2. Assess the effect on the service
Consider how likely each event is during the move and what it would mean for customers and staff. Review existing arrangements, including access from another location and any remaining dependence on physical records or equipment.
Use the organisation's own criteria. This example deliberately gives no numerical rating because a defensible score would need evidence about the service, timetable and controls.
3. Choose controls and decide what can proceed
The team might arrange a connectivity test before the move, stage the transfer of staff and equipment, and agree a fallback location. Give each action an owner and completion date.
Agree who can approve the move and what evidence that person needs. If essential connectivity is unconfirmed, the decision might be to delay part of the move rather than assume the supplier will be ready.
4. Put the controls into operation
Complete the test, confirm access and make sure staff know how to use the fallback arrangements. A plan written in a register is not the same as a control that is ready to use.
Record any unresolved actions and explain how they affect the decision. Consider whether the workaround introduces new risks, such as access problems or reduced staffing cover.
5. Supervise, review and learn
Check service availability during the move and give staff a clear route for reporting problems. Reassess if installation is delayed or the fallback arrangement does not work as expected.
Afterwards, review incidents, remaining actions and lessons for future moves. Keep responsibility for any ongoing risk clear.
How should the process be reflected in everyday work?
The process should be visible in decisions and follow-up, rather than existing only as a completed assessment form. Include relevant risks in planning discussions, handovers, briefings and management reviews.
For each significant risk, keep a record of its description, existing controls, remaining exposure, owner and next review. Explain which decisions depend on a control being in place.
An online risk register can support shared records and action reporting. It does not replace the judgement or authority needed to decide whether work should proceed.
Common questions
Is composite risk management the same as a risk assessment?
Assessment is part of the wider process. It helps judge the risk; management also includes deciding on a response, implementing controls and checking what happens afterwards.
Does a business need military scoring rules?
This business example uses no military scoring rules. Choose assessment criteria and decision arrangements appropriate to your organisation and activity. For specialist military requirements, refer to the relevant official publications.
What is the difference from an ordinary business risk process?
There is substantial overlap in identifying, assessing, treating and reviewing risks. The emphasis here is on considering exposures together and carrying the findings into decisions. Our business risk management process guide explains the broader cycle, while the project guide shows its use during delivery.