Risk Identification and Assessment
Core idea
Identification aims for completeness; assessment aims for comparability. Candidates must know a range of identification techniques and when each fits: brainstorming and workshops for breadth, structured interviews and Delphi for expert judgement without group pressure, checklists and prompt lists for routine operations, process mapping and bow-tie analysis for causal chains, scenario analysis for low-likelihood high-impact events, and incident data review for historical patterns.
Assessment concepts
Understand qualitative, semi-quantitative and quantitative assessment. Know the components of a risk matrix (likelihood and impact scales, defined criteria for each level) and its weaknesses: range compression, inconsistent scale interpretation, and false precision. Understand expected value, sensitivity analysis and Monte Carlo simulation at a conceptual level, plus the difference between inherent and residual scoring. Recognise correlation and clustering: risks that appear independent may share a common cause and should be assessed together.
Traps
Questions frequently test bias: availability bias inflates familiar risks, anchoring fixes on a first estimate, and groupthink suppresses dissent in workshops. Another trap is treating a high score on a matrix as an objective fact rather than a calibrated judgement. Also watch for confusing likelihood with frequency, and impact with duration.
Worked rule of thumb
When scoring, define anchors explicitly. For impact, state what '4 - Major' means in money, downtime and harm, so two assessors reach the same score. Then apply a sanity check: if a risk scores high but has never been tested by a near miss, ask whether the estimate is evidence-based or merely vivid.