Risk Identification, Analysis, and Evaluation
Identification, analysis and evaluation are examined together because candidates often jump from a list of risks to a colour on a heat map without showing the reasoning in between.
Identification
Use more than one technique: brainstorming, structured interviews, Delphi, checklists, process mapping, HAZOP for process deviations, FMEA for failure modes, bow-tie for causes and consequences, fault and event trees, SWOT and PESTLE for context, incident reviews, audit findings, KRI triggers and horizon scanning. Good identification is broad before it is deep, and it captures opportunities as well as threats.
Analysis
Determine the drivers: likelihood, consequence, timing, velocity, duration, controllability and interdependencies. Choose qualitative, semi-quantitative or quantitative methods to suit data quality and decision stakes. Record assumptions and data sources. Correlation matters: ten “independent” supplier risks may share one port, one cloud provider or one regulator.
Evaluation
Compare the analysed risk with criteria. Ranking, ALARP reasoning and appetite limits are evaluation tools. Risk matrices are popular but compress ranges and invite false precision; ordinal scores should not be multiplied and treated as ratios.
Worked example
An FMEA scores a failure mode severity 8, occurrence 4, detection 3, giving RPN 96. A new inspection step improves detection to 2, so RPN becomes 64. A team that only watches RPN may deprioritise the item, yet severity is still 8 - a serious safety or regulatory outcome. The correct evaluation uses criticality (severity × occurrence), notes that detection reduces the chance of escape but not the harm, and keeps the item high on the register. Reasoning shown: the improvement is real but does not change the worst-case consequence, so the evaluation must not rely on a single composite number.
Traps that cost marks
Running one brainstorm and calling identification complete; using RPN league tables as the only prioritisation; ignoring common-cause and correlated risks; availability bias (over-weighting recent incidents); anchoring on the first estimate; applying arithmetic to ordinal scales; evaluating without documented criteria or appetite.