Risk Identification and Assessment
Risk identification is the systematic process of finding, recognizing, and describing risks that could affect objectives. Candidates should know the main techniques and when each fits: brainstorming and workshops for breadth, interviews for depth, Delphi for expert consensus without groupthink, SWOT for strategic context, checklists and taxonomies for completeness, process mapping and flowcharts for operational risks, HAZOP and FMEA for process and product failure modes, scenario analysis for low-frequency/high-impact events, and incident data and loss-event databases for empirical grounding.
Assessment combines likelihood and impact to produce a risk rating, typically plotted on a risk matrix (heat map). Understand qualitative, semi-quantitative, and quantitative assessment, and the concept of risk criteria (thresholds defining significance). Know the difference between inherent and residual assessment and the role of control effectiveness ratings.
Traps: assuming a risk matrix is objective (it embeds judgment and can suffer range compression); treating identification as a one-time exercise; confusing a hazard (source of harm) with a risk (effect of uncertainty); and forgetting opportunity risks. Also watch for questions that confuse FMEA (failure modes and effects) with fault tree analysis (top-down causal logic).
Rule of thumb: Identify broadly, assess consistently, and document assumptions. Worked example: a workshop identifies a supplier failure risk rated likelihood 4 (likely) and impact 5 (severe) = score 20, above the 15 threshold, so treatment is required; after adding a dual-sourcing control, likelihood falls to 2, residual score 10, below threshold.