SOSMART criteria:

  • Standalone - reads like a really good headline, no further reading or reference is needed to understand
  • Opportunity - answers the question of "so what", it addresses who is affected, how, by how much and provides evidence
  • Specific - identifies the specific risk, what is the issue, what is the impact to the organization?
  • Measurable - the risk must be stated quantitatively and qualitatively, enabling fact-based decision making and status updates?
  • Attainable - the risk is actionable with time, skills, resources (people or $$) available?
  • Relevant - Related to organizational goals and is a high priority?
  • Time bound - are the deadline and milestones are clearly defined?