Assessing risk
After identifying potential risks, the next step is to engage in risk assessment. Risk assessment ensures that risk management efforts are directed at risks that have been assessed as being a high priority.
Risk assessment is based on:
- the probability (likelihood) that something bad will happen, or that something necessary will not happen
- an estimation of the consequences or severity.
Risk management is not only conducted during the planning phase: it should be reviewed periodically, and adjusted to emerging stakeholder issues and dynamics. Results of the risk assessment can be recorded on the Risk assessment and management plan [MS Word
(26KB) or PDF
(6KB)].
Risk ranking table
To arrive at a risk rating, analyse each identified risk using the following risk ranking table. This involves making an estimation of the probability of the event occurring and the level of negative consequence or impact associated with the risk event occurring. By combining the two estimations, you will arrive at a risk rating of Low, Medium, High or Very High. Risk management strategies can then be prioritised, based on the risk rating. Refer to the table Responses to different levels of risk.
Level of negative consequence on project outcomes or agency
| Probability of occurring | 1 not at all (won’t happen) |
2 a little (can live with it) |
3 a fair bit (moderate) |
4 quite a bit (significant) |
5 a lot (extreme) |
|---|---|---|---|---|---|
| 1 not at all (won’t happen) |
1 Low |
2 Low |
3 Low |
4 Med |
5 Med |
| 2 a little (unlikely) |
2 Low |
4 Low |
6 Med |
8 Med |
10 Med |
| 3 a fair bit (possible) |
3 Low |
6 Med |
9 Med |
12 High |
15 High |
| 4 quite a bit (likely) |
4 Low |
8 Med |
12 High |
16 Very High |
20 Very High |
| 5 a lot (almost certain) |
5 Low |
10 Med |
15 High |
20 Very High |
25 Very High |
Responses to different levels of risk
| Risk level | Action |
|---|---|
| Low risk | Do nothing initially, check occasionally. |
| Medium risk | Monitor closely, take action if possible, notify/advise key agency members of possible risk. |
| High risk | Mitigation strategies needed. |
| Very high | Action is mandatory to reduce or manage the risk. If you are not likely to be able to manage this risk or the consequences, consider changing project goals and outcomes or review whether the project should proceed. |



Previous