Skip to main content
Regulatory Council
The state of ai impact assessment
Category: Risk Assessment & Analysis

Key Assumptions

Also known as: Critical Assumptions, Planning Assumptions
Simply put

Key assumptions are the factors that planners treat as true or certain in order to move forward with a project or plan, even when there is no firm proof at the time. Because these assumptions form the basis for schedules, budgets, or payment plans, they carry the risk that decisions built on them may fail if an assumption turns out to be wrong.

Formal definition

In project and planning contexts, key assumptions are those assumptions specifically identified as critical to a defined plan and used as the foundation for dependent outputs, such as a payment plan built on a project plan. They represent conditions accepted as true, real, or certain for planning purposes despite the absence of proof, and are typically documented and monitored because their validity directly affects planned objectives. Practitioners commonly assess assumptions against parameters such as confidence level (how certain the assumption is held to be) and lead time (the interval before the assumption must hold or be validated), enabling assumptions to be treated as sources of uncertainty and, where they may adversely affect objectives, as candidates for risk identification and treatment. The precise scope and criticality of a given assumption is context-dependent and varies by plan; assumptions in specialized settings, such as the statistical assumptions underlying regression models, are distinct in nature and should not be conflated with project planning assumptions.

Why it matters

Key assumptions matter because they are load-bearing: schedules, budgets, and dependent outputs such as a payment plan built on a project plan rest on conditions that are accepted as true, real, or certain for planning purposes even though proof is absent at the time the plan is set. When an assumption that a plan treats as fixed later proves false, the effect can cascade through every dependent output, undermining the objectives those plans were meant to serve. This is precisely why assumptions are treated in many risk frameworks as sources of uncertainty rather than settled facts.

Because assumptions are, by definition, unproven, they occupy the boundary between governance discipline and risk management. Documenting and monitoring key assumptions makes the reasoning behind a plan transparent and challengeable, which supports accountable decision-making. Where an assumption could adversely affect objectives, it becomes a candidate for risk identification and treatment, allowing an organization to plan for the possibility that the assumption fails rather than discovering the failure only after commitments have been made.

It is worth noting that not all assumptions are alike. The statistical assumptions underpinning models such as regression, for example, are distinct in nature from project planning assumptions and should not be conflated with them; the criticality and scope of any given assumption is context-dependent and varies by plan.

Who it's relevant to

Project and program managers
Those responsible for defining project plans and dependent outputs, such as payment plans, rely on key assumptions as the explicit basis for their schedules and budgets. Identifying, documenting, and monitoring these assumptions, including their confidence level and lead time, helps make the plan's foundations visible and reviewable.
Risk managers
Because assumptions represent conditions accepted as true without proof, they are natural candidates for risk identification where they may adversely affect objectives. Risk managers can treat unvalidated or low-confidence assumptions as sources of uncertainty and apply appropriate treatment.
Governance bodies and decision-makers
Those approving plans and committing resources benefit from transparency about the assumptions underlying a plan. Documented assumptions allow decision rights to be exercised with a clearer view of what is being taken as certain and what remains unproven.
Internal auditors and assurance providers
Auditors reviewing planning processes can examine whether key assumptions are identified, documented, and monitored, and whether those that could affect objectives have been carried into risk processes. The scope and criticality of assumptions is context-dependent, so review should account for the specific plan involved.

Inside Key Assumptions

Underlying Premise
The specific condition, estimate, or state of affairs that is taken to be true for the purpose of analysis, planning, or decision-making, but which has not been fully verified and may change over time.
Basis for Estimates and Projections
Assumptions frequently support risk assessments, financial forecasts, capital planning, and scenario analysis by supplying the input values or conditions on which quantitative and qualitative outputs depend.
Sensitivity and Dependency
The degree to which a conclusion or outcome would change if a given assumption proved incorrect, which helps identify which assumptions are most material to a decision or model result.
Documentation and Traceability
The recorded articulation of each assumption, its rationale, its source, and its owner, enabling later review, challenge, and validation as part of governance and control processes.
Validity Period and Triggers
The conditions or timeframe under which an assumption is expected to hold, together with events that would prompt its reassessment, since assumptions are typically time- and context-dependent.
Ownership and Accountability
The assignment of responsibility for monitoring and revalidating an assumption, which supports governance clarity over who is accountable when circumstances change.

Common questions

Answers to the questions practitioners most commonly ask about Key Assumptions.

Are key assumptions the same as risks?
No, though the two are closely related and often confused. A key assumption is a condition or premise taken to be true for planning or analysis purposes, whereas a risk is a potential event and its effect on objectives. An assumption typically becomes a source of risk when there is meaningful uncertainty about whether it will hold. In practice, many organizations treat the failure of a key assumption as a risk trigger, but the assumption itself is the underlying premise rather than the potential event. Conflating the two can obscure the analytical step of testing whether the premise is actually valid.
Does documenting a key assumption reduce or control the associated risk?
Not by itself. Documenting an assumption improves transparency and makes the premise visible for challenge, but documentation is a recording activity rather than a control that modifies risk. A control is a measure intended to modify risk, such as monitoring the assumption's continued validity or establishing a response if it fails. Recording an assumption may support better risk treatment decisions, but it should not be mistaken for the treatment itself. The distinction matters because an unexamined but well-documented assumption can still fail.
Who should be responsible for identifying and validating key assumptions?
Responsibility typically rests with the owner of the plan, forecast, or analysis in which the assumption is embedded, often with review by a second party such as risk management or internal audit to provide challenge. Assigning a named owner to each material assumption helps ensure it is periodically revisited rather than treated as permanently settled. Governance structures in many organizations designate decision rights for approving assumptions used in significant decisions, though the specific allocation varies by organization size, sector, and internal policy.
How often should key assumptions be reviewed?
There is no single prescribed frequency, and appropriate cadence depends on how volatile the underlying condition is and how material it is to objectives. Assumptions tied to fast-moving external factors may warrant frequent review, while more stable premises may be revisited on a periodic cycle or when a defined trigger event occurs. Many organizations align assumption reviews with existing planning, forecasting, or risk assessment cycles, and supplement these with event-driven reviews when circumstances change materially. The approach should be documented so it can be applied consistently and defended if challenged.
How should key assumptions be documented so they are useful?
Effective documentation typically captures the assumption itself, its rationale or source, an owner, the date recorded, and an indication of how and when its validity will be tested. Recording the potential consequences if the assumption fails can help link it to relevant risk assessment and treatment activities. Keeping assumptions in a location that is reviewed as part of ongoing governance, rather than in a static one-time record, helps ensure they remain live and open to challenge. The level of detail should be proportionate to the assumption's materiality.
What should happen when a key assumption is found to be invalid?
When an assumption no longer holds, the analysis, plan, or decision that relied on it should generally be revisited, since its conclusions may no longer be supported. This may prompt reassessment of associated risks, revision of forecasts, or escalation to those with the relevant decision rights. Establishing in advance what response will follow the failure of a material assumption, sometimes framed as a trigger or contingency, can make the organization more responsive. Whether escalation is required, and to whom, depends on the assumption's materiality and the organization's governance arrangements.

Common misconceptions

Key assumptions are facts once they are documented.
Documenting an assumption records that it was made and why; it does not verify it. Assumptions remain provisional conditions taken to be true and can prove incorrect, which is why many frameworks emphasize periodic revalidation.
Assumptions belong only to modeling or finance and are not a governance or risk concern.
Assumptions can legitimately span all three GRC pillars. They inform risk assessments and controls, require governance over ownership and challenge, and can affect the reliability of compliance-related reporting. Their treatment is often a matter of control design rather than modeling alone.
If assumptions are conservative, the resulting risk estimate is reliable.
Conservatism does not guarantee accuracy or eliminate risk. An assumption may be biased in an unexpected direction, and materiality depends on sensitivity. Even prudent assumptions should be tested and monitored rather than treated as ensuring a correct outcome.

Best practices

Document each key assumption explicitly, including its rationale, source, owner, and the conditions or timeframe under which it is expected to remain valid.
Perform sensitivity analysis to identify which assumptions are most material to a decision or model output, and focus review effort accordingly.
Assign clear ownership for monitoring and revalidating assumptions, so accountability is defined when underlying conditions change.
Define triggers and a review cadence that prompt reassessment when relevant circumstances shift, rather than treating assumptions as permanently settled.
Subject significant assumptions to independent challenge or review as part of governance and control processes, to reduce the risk of unexamined bias.
Verify quantitative inputs and effective dates against primary sources where feasible, and flag any assumption that requires legal or specialist judgment as needing professional advice.
Promotional banner highlighting failures found in PCI audits and how to spot the gaps