Risk management
The first knowledge-transfer element covers risk management, including communication at the transition points where risk is transferred.
What the public record carries
Not stated in the public record beyond the element title, and the introduction's note that this element, because it reaches across organisations, carries extra text on the exchanges at a major handover. The text of 5.3.2 is not public.
Basis. The public contents name the element and the first edition's introduction says it carries extra communication sub-clauses. The text is not public.
Why it matters in a health estate
Risk is the element most often transferred in name and not in fact. A supplier's residual risk statement can be accepted by a buyer who has no ability to mitigate it. The transfer needs the risk, the assumption behind it, the mitigation still available and the party who accepts the residual. Without those four, the acceptance is a signature on a document no one can act on.
What to do now
Build a risk transfer record with the risk, the assumption, the remaining mitigation, the accepting party and the date. Check that the accepting party can actually act on the mitigation. Where it cannot, the risk has not been transferred.
The evidence a reviewer will ask for
| Evidence | What it is |
|---|---|
| Risk transfer record | Risk, assumption, remaining mitigation, accepting party and date |
| Assumption list | Every assumption on which the residual risk depends |
| Capability check | Evidence that the accepting party can operate the remaining mitigation |
| Escalation | What happens when a transferred risk can no longer be mitigated |
What a reviewer will ask
A reviewer will ask who accepted the residual risk and whether they can do anything about it. A signature from a party with no capability is not an acceptance.
Common gaps
- A residual risk is accepted by a buyer who cannot operate the mitigation
- The assumptions behind a residual risk are not listed
- A risk is transferred at go-live and the transfer record is never revisited
- Two parties each believe the other accepted the same risk
Before the draft publishes
Take one transferred risk and test whether the acceptor can act. If not, reopen the transfer.
If the draft changes this row
The draft is edition 2 and 62 pages, one page more than the first edition. Its text and any change summary are not public as at 21 October 2026. This row follows the published first edition's structure, which is what your procedure should name today. The change watch emails you when the record changes or the draft text lands, and the row is re-read then. No one can tell you what moved before that, and this page does not guess.
Related rows
Who this binds. The risk owner and every party that accepts a risk at a transition point, because this element carries risk across organisations.