This section looks at reviewing the progress made so far and planning the next steps. This is important to ensure that the SSA process is kept on track, and that it adapts to new information and other changes during the SSA. Whilst it is important to think through the order in which the steps are conducted, the SSA process is flexible and iterative and the steps do not always follow the same order from one SSA to another.

In particular, as each step of the process is worked through, it can be helpful to consider any implications for later in the SSA. For example, a large number of stakeholders may be identified during the Identify stakeholders activity in the Examine phase, and it may then be necessary to set up several meetings with smaller groups, or to book a larger meeting room to accommodate them together.

As the SSA progresses and new information becomes available, it is important to revisit earlier steps. How thoroughly this should be done may not only depend on the size of the risks (high-risk situations deserve more analysis), but may also be influenced by the time available. Sometimes a quick glance over the earlier steps is all that is required.

For example, when working through the Identify risk activity in the Assess phase, it may be realised that the map of the system is incomplete and that it would be useful to go back to Describe system in the Examine phase, in order to revise the system map. Following this, when working through Identify stakeholders, it may be necessary to check whether the changes to the system map indicate any additional stakeholders or people to engage in the process. Identify risk could then be revisited.