Risk management > Risk management > How do I manage risks? >

Analyse risks

Purpose
Actions
Key Questions
Outcomes

Purpose

This step seeks to determine the level of risks identified.

Risks are analysed in terms of likelihood and consequence.

You must also evaluate the processes and procedures (controls) that your organisation has in place to deal with those risks.

Actions

Determine the likelihood and the consequences of each risk occurring.

Likelihood is used as a description of probability or frequency, or simply: 'What is the chance of the risk occurring?'

Likelihood is considered on a four point scale:

almost certain
likely
possible
unlikely

Consequence is the potential outcome or impact of a risk occurring. When determining the consequence of a particular risk, you should consider:

the number of people involved
the possible cost to the organisation (for example, in terms of financial liability, damage to reputation, and cost of mitigation).

Consequences are considered on a four point scale. (new window) 197k

Evaluate the adequacy of existing controls

Your organisation may already have a number of controls in place to reduce the likelihood or consequence of risks. These controls may take the form of systems, processes and procedures. But are the controls as effective as they could be?

When assessing the likelihood and consequence of risks, you must also evaluate existing controls to assess:

the effectiveness of the control
the frequency of its implementation.

Effectiveness of the existing control

Assess and indicate how effective the existing controls are for mitigating the risk. Effectiveness can be assessed by a number of methods, including:

a structured audit approach
the effectiveness of the controls in prevention or reduction of risks
the flexibility of controls in dealing with slightly modified circumstances.

Once an assessment of the existing controls has been made, indicate their effectiveness on the Department's Existing controls template (new window) 2.6M .

Frequency of Existing Controls

Assess how rigorously the existing controls have been implemented or enforced by management. This is an essential consideration: even though the existing controls may be adequate, the risk may remain unaffected if the controls have not been effectively implemented.

Indicate on the Existing controls template (new window) 2.6M the implementation level of existing controls.

Once the existing controls have been assessed, further consideration can be given as to whether they require modification, or whether other controls are needed.

Determining the controlled level of risk

Controlled risk is the level of risk that remains after considering the effectiveness of existing controls.

Indicate on the Risk register template (new window) 2.6M the likelihood and consequence of each risk, after you have considered the effectiveness of existing controls.

Having considered the likelihood and consequences of individual risks, and the effect of existing controls, the controlled level of risk can be determined using the Department's Risk management matrix. (new window) 197k

Key Questions

What are the potential consequences of each risk if they occur?
What is the potential likelihood of the risks happening?
What current controls presently exist to prevent, detect or lower the consequences or likelihood of the risk?
How well are these controls enforced by management?

Outcomes

The outcomes of this step are:

an established level of risk for each identified risk
a detailed understanding of the possible impact of risks upon the successful achievement of organisational objectives.

The following documentation should be entered into the Risk register template (new window) 2.6M :

the likelihood and consequence ratings
an evaluation of existing controls
level of risk.

The existing controls, if any, for each risk should be documented in the Existing controls template (new window) 2.6M .

^ Top of page