Risk Identification

Define the risk precisely

A useful risk statement identifies an uncertain event, its cause and its possible effect. “The project is risky” is too vague to guide action. A stronger statement is: “If the untested payment process fails during launch, customer transactions may be delayed and trust may be damaged.” Precision allows the decision maker to investigate evidence, assign responsibility and design a relevant safeguard.

Separate the event from the consequence. The event may be a supplier delay, system failure, misunderstanding, illness, price change or breach of an agreement. The consequence may involve money, safety, time, relationships, reputation or service continuity. One event can create several effects, and one consequence can arise from several causes.

Review relevant risk categories

Examine only the categories that genuinely apply. Operational risk concerns whether a process, person or resource can perform as required. Financial risk concerns loss, affordability, cash flow or uncontrolled commitment. Relational and reputational risk concern trust, communication and public conduct. Legal, ethical, privacy, health and safety risks may require specialist attention where the decision affects protected interests or vulnerable people.

A category list is a prompt, not a substitute for judgement. Do not add dramatic possibilities merely to make an assessment look comprehensive. Concentrate on credible exposure supported by the nature of the decision, previous experience, available evidence and professional advice where necessary.

Estimate likelihood, severity and duration

Likelihood asks how reasonably probable the event is. Severity asks how serious the consequence could become. Duration asks how long the effect may continue. These dimensions should be recorded separately because a frequent minor problem differs from an unlikely but catastrophic event. Avoid false numerical precision when evidence is weak; terms such as low, moderate and high should be accompanied by a short explanation.

Consider who is exposed and whether they can recover. The same financial loss may be manageable for one organisation and devastating for an individual. A temporary delay differs from permanent loss of access, trust or opportunity. Significance depends on context, not merely the name of the risk.

Assess reversibility and recovery

Ask whether the action can be stopped, reversed or corrected. Reversible decisions may justify a small experiment when evidence is incomplete. Irreversible decisions require stronger verification, wider consultation and clearer authority. Recovery planning should identify the time, money, cooperation and expertise needed to restore an acceptable position.

A risk becomes more serious when warning signs are difficult to detect or when recovery depends on resources that are not available. Define the earliest observable indicator that the direction is becoming unsafe or unproductive. Early detection can turn a major failure into a manageable correction.

Design proportionate safeguards

A safeguard should reduce either the likelihood of the event, the severity of the effect or the difficulty of recovery. Examples include identity verification, staged payment, written consent, spending limits, backups, independent review, testing, insurance, supervision and clearly defined exit conditions. The safeguard must correspond to the actual risk.

Record who owns the safeguard and how its operation will be verified. A control that exists only in a document may provide false confidence. Where risk cannot be reduced sufficiently, the responsible decision may be to delay, redesign or reject the option. Risk identification is not an instruction to avoid every uncertainty; it is a method for choosing exposure consciously.

Common risk-identification errors

One common error is listing every imaginable danger without judging relevance. This creates noise and can make responsible action impossible. Another is focusing only on events that are easy to measure while ignoring trust, consent, dependency or recovery. Risk descriptions should remain specific, evidence-based and connected to a decision that can actually be changed.

Do not treat a safeguard as proof that the risk has disappeared. Controls can fail, be ignored or operate differently from their design. Review whether the safeguard is active, whether the responsible person understands it and whether a backup response exists when the first protection does not work.

Practical risk-register questions

• What uncertain event could materially affect the decision?
• What evidence supports its likelihood?
• Who or what would be exposed?
• How severe and lasting could the effect become?
• Can the action be reversed or recovered from?
• Which safeguard, warning indicator and owner are required?