Some of the most effective business decisions come from deliberate restraint rather than rapid action. For example, risk professionals often face pressure to take decisive action to “return to normal” even when conditions remain uncertain, while the most prudent response would be to actively monitor the situation until the picture becomes clearer.
The 4Ts model of Tolerate, Treat, Transfer and Terminate remains a central framework for risk response and appears in standards such as ISO 31000 and COSO ERM, but the 4Ts may not fully reflect what organizations do in practice. Organizations must understand not only their appetite for risk but also how much uncertainty they can accommodate. In this context, an element is missing from the 4Ts: the deliberate decision to wait while closely monitoring a risk, or “Track.” This distinct strategic response could be considered the fifth T. By incorporating Track into their risk management process, organizations can help ensure they are making the most effective decisions possible in any scenario.
Why “Track” Matters
At first glance, adding another category to the 4Ts may not seem necessary. Monitoring is already a key part of risk management. Risk professionals update registers, review controls and reassess risks, but this usually accompanies another response. They treat, transfer or tolerate a risk, then monitor to ensure the response remains appropriate.
However, tracking is different. It is a deliberate choice not to act yet because conditions are too uncertain, information is too limited or timing is not optimal. It is a temporary holding strategy that preserves flexibility while circumstances evolve.
Formalizing Track as part of risk response matters because many environments are fast-changing and information often emerges gradually. Premature action can close off better options or shift risk elsewhere. In such cases, waiting is not passive—it is disciplined and accountable, especially when knowledge is incomplete.
A practical starting point to incorporate Track into your risk response process is to review your current risk register and identify risks where immediate action is hard to justify. These are typically high-uncertainty risks with multiple possible outcomes or dependencies on external decisions. If you find yourself repeatedly deferring action without clear reasoning, it may be a sign that the risk needs structured tracking rather than indefinite postponement.
The Most Under-Used “T”
To understand why Track is underused, consider two linked challenges: 1) the action bias that pushes for early decisions and 2) the hindsight bias that punishes restraint once events unfold.
The Action Bias Problem. Recommending “wait and see” is difficult within organizations that prize visible action. Risk managers feel pressure to demonstrate they are doing something, and this can distort priorities, consume resources prematurely and create a false sense of progress.
Because activity is often valued more than judgement, professionals may hesitate to propose strategically waiting even when they believe it is the most prudent option. Many fear the stigma of being seen as indecisive or insufficiently proactive. However, decisions often involve a trade-off between moving forward and gathering enough information to act well. Track provides a legitimate label for this disciplined pause by reframing a delay as a conscious, time-sensitive response to uncertainty, grounded in professional judgement and supported by clear escalation conditions.
The Hindsight Problem. Every Track decision may eventually face hindsight bias. Fear of retrospective criticism encourages premature decisions that appear decisive even when suboptimal, while patient tracking is punished regardless of its merit at the time. The consequence is that once outcomes become clear, critics claim they “knew all along” what should have been done.
To best prepare for this tendency, practitioners should document reasoning at the point of decision, including what was known, what remained uncertain and what triggers would prompt action. It is equally important to make sure you do not engage in hindsight bias yourself. Judge past decisions based on the information available then, not by later events. A well-structured Track response that produces a suboptimal outcome may still be better risk management than a lucky guess or premature action.
What Track Looks Like in Practice
Track already happens informally and can be either active or passive. Understanding this distinction helps explain how it differs from the existing 4Ts.
Consider the analogy of a goalkeeper facing a penalty shot. Goalkeepers who choose not to move during penalty shots have higher success rates than those who dive, even though this appears counterintuitive to spectators who expect immediate action. A goalkeeper deciding in advance to stand still based on statistical analysis represents a classic Tolerate approach from the existing 4Ts.
Track is different. Rather than committing to a specific strategy in advance, the goalkeeper would delay their final decision, actively monitoring the penalty-taker's approach, body language, run-up angle and hip positioning. This preserves multiple response options until the moment when maximum information is available. The key distinction is timing and intent. Tolerate means accepting the risk itself because other treatments are not appropriate, whereas Track keeps all treatments open and deliberately postpones the choice while conditions continue to evolve.
The Federal Reserve's 2012 deliberations offer a masterclass in active Track. As the economy nursed wounds from the recession, Federal Reserve Chairman Ben Bernanke faced intense pressure. Hawks like Richmond Fed President Jeffrey Lacker warned of inflation risks from continued quantitative easing. External voices like economist Paul Krugman urged patience, while financial media warned the Fed was behind the curve. Rather than setting predetermined thresholds and waiting passively for them to be breached, like a stop-loss order in currency markets, the Fed employed active Track. They did not simply monitor inflation and employment against fixed targets; they continuously recalibrated their understanding of what "full employment" meant in a post-crisis economy, adjusted their assessment of inflation risks as global dynamics shifted, and evolved their communication strategy as markets digested each round of quantitative easing. When labor force participation rates fell unexpectedly, they reconsidered whether traditional metrics still captured economic slack. This active tracking, including constantly reassessing both the risk and the response thresholds themselves, allowed them to maintain appropriate policy longer than passive triggers would have permitted.
Track is particularly useful for interdependent risks. Modern risks often cut across departments, supply chains and jurisdictions, and acting too quickly in one area can have unintended consequences elsewhere. Tracking enables coordination and time for wider consultation before decisions become locked in. Most complex risks benefit from a blend of passive metrics and active contextual monitoring.
A Four-Step Process for Implementing Track
For Track to function as a fifth T in practice, it must be structured. “We will keep an eye on it” is not enough of a strategy. A responsible tracking process includes four key steps:
- Recognize when Track is appropriate
To recognize when Track is the appropriate response, look for situations where volatility dominates, information remains incomplete or premature action could lock the organization into suboptimal paths. In such cases, inaction today can preserve the freedom to act more effectively tomorrow. For example, during political transitions, manufacturers may choose to delay operational changes because committing to any regulatory framework while conditions are fluid risks costly error.
- Define what you are tracking and how
Once you decide to track, define what you will monitor. Identify the variables that matter most, the sources of reliable data and the frequency of review. For example, a consumer goods firm facing supply chain uncertainty might track policy announcements, logistical cost changes and competitor adjustments. This should turn vague watching into systematic observation.
- Establish review timelines
Next, look to establish clear timelines and triggers to prevent drift. Tracking must remain provisional. Effective triggers might include numerical thresholds, competitor actions or specific regulatory milestones. Examples could include a 15% price shift, two major competitors adopting a new standard, or a 10% increase in enforcement action.
Communicate rationale and escalation conditionsFinally, communicate the rationale. Stakeholders should understand why Track was chosen, what conditions would prompt a shift and how updates will be provided. An initial message might explain that Track preserves flexibility until key uncertainties resolve. Subsequent updates can confirm whether triggers have been met and when the next review will occur. If escalation is needed, communication should be clear and decisive.
How to Ensure Discipline in Tracking
For tracking to function as a disciplined strategy rather than a convenient holding pattern, these habits are essential:
Revisit tracked risks regularly. Rather than being left to drift, ensure risks receive scheduled review and adjust triggers and thresholds as new information emerges. Tracking must remain active and cannot slip into set-and-forget mode.
Communicate the rationale clearly. Those overseeing the risk should understand why Track was chosen, what variables are being monitored,and which indicators would trigger a shift in response. Clear explanation should help stakeholders understand you are acting with deliberate caution, not indecision.
Avoid waiting for perfect information. No matter how much research you do, many risks are likely to include some element of uncertainty indefinitely. Track is not a justification for indefinite delay when uncertainty is not reducible.
Approach tracking with rigor rather than avoidance. Track should never become a way to park uncomfortable issues or postpone decisions because because action is politically awkward. Tracked risks still require engagement, documentation and periodic reassessment.
Risk professionals are often expected to advise, intervene and act act, but sometimes it is better not to act immediately. The value of tracking lies in the idea that timing is a core competency in risk management. Its relevance is greatest where uncertainty is expected to decrease, where conditions are still forming, and where premature action would close off better options.
Next time a risk surfaces and the urge to move quickly takes over, ask yourself:
- Is this a risk where key uncertainties are genuinely time sensitive and likely to resolve?
- Is our reluctance to wait grounded in uncertainty or fear of looking passive?
- Are we acting because it is the right decision or because it is visible?\
- Would stepping back actually serve the organization more effectively?
Bringing Track into the 4Ts framework is not about slowing down—it is about thinking ahead. It applies where waiting is likely to improve the quality of information or reveal clearer pathways, giving risk professionals permission to pause, observe and preserve options. In a world where risks evolve quickly, Track can help organizations align decisions with clarity rather than urgency.