MAINSYSTEMS 
decide risk-plan changes based on incidents and implementation tests
1. Regulatory Concept & Core Standards
In this video we will consolidate a skill: decide risk-plan changes based on incidents and implementation tests. Use the case to test what you would do in a similar situation. We will explain the proposed response step by step so that you can understand each choice and recognise when more information would be needed. After preventive measures are approved, the organisation must establish whether they were implemented and produce results. This course addresses indicators, evidence and review. Internal timetables are management choices unless a specific national obligation is expressly identified.
The risk plan must reflect relevant changes in activity, structure, third parties and controls. Periodic review is management practice and may also follow specific rules. Record changes, reasons and owners. Reporting outcomes can reveal systemic weaknesses but must not become identifiable public annexes.
Apply the following rule: The HinSchG covers criminal offences, certain administrative offences protecting life, health or workers' rights, and the matters listed in section 2. A breach of an internal rule does not automatically fall within the statutory scope.
2. Practical Implementation & Procedure
Gather control failures, activity changes, audits and aggregated incident information. Assess matrix implications and consult departments. Update owners, measures and priorities. Record versions, required approval and dissemination. Preserve history to explain the plan's evolution rather than rewriting past assessments as though unchanged. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.
3. Case Study & Compliance Action
An entity starts awarding financial support, an activity absent from its previous matrix. New decisions create new risks. The team adds the process, assesses exposure and sets controls before the next monitoring cycle. Earlier incidents inform it in aggregate, without copying individual reports into the plan. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.
The exercise is as follows: Does a scheduled review date prevent earlier changes when activity changes? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.
No. The plan must reflect real risks. A material change can justify early review and may trigger specific national duties. Document the change, review controls and assign owners without waiting for an internal date when risk has already changed.
One mistake to avoid is: keeping an outdated plan until the scheduled review date.
Now apply the national rule to a second decision. A report is automatically classified as protected because it contains the word corruption. What check is missing?
Read the facts and apply the national scope, context and conditions for protection. A form label helps organise information but does not determine the legal framework. If the case falls outside the regime, identify an appropriate route without unnecessarily disclosing information.