I would second Steve’s comments and would like to discuss what Steve is talking about more in a working group, as many of these techniques not only require high levels of support, but also would need to align with/comport with their other Orders/Policy/Guidance in effect, which may limit options.
Also, and building on Steve’s points, what about agencies in which much of the analysis leading to risk elevation is done within the bureaus/sub-offices and not within the CRO’s shop? Or, where there may not necessarily be a CRO or an official focused only on this topic? These are challenges in risk analysis we need to give more attention to because rarely, if ever, does an agency have capacity for all that is discussed within guidance documents.