Initiation of the Risk Management Process and Risk Assessment
Domain 3 - Initiation of the risk management process and risk assessment
This domain tests whether you can set up the process correctly and move from identification through analysis to evaluation without skipping a step.
Core rules
- Communication and consultation is a transversal activity, not a first step that finishes.
- Scope, context and criteria define objectives, boundaries, internal and external context, and - critically - risk criteria: how significance is measured, the likelihood and consequence scales, how multiple consequences combine, and the organisation's risk appetite and tolerance. Criteria are agreed before assessment, not reverse-engineered to fit a preferred result.
- Identification finds, recognises and describes risks, including sources, causes, events and consequences. It must cover opportunities as well as threats, and must not filter out risks merely because controls exist.
- Analysis develops understanding of the nature, level and complexity of the risk: likelihood, consequences, control effectiveness, uncertainty and interdependencies.
- Evaluation compares analysis results with the criteria to decide whether to accept the risk as it stands, treat it, or reconsider the objective.
Worked example
A 5×5 matrix gives a delivery-failure risk consequence 4, likelihood 3, score 12. The criteria state 15+ is unacceptable, 8–14 tolerable subject to treatment, below 8 acceptable. Score 12 means treat. After adding a second qualified carrier, likelihood falls to 2 and the residual score is 8 - still tolerable, so treatment is planned but not complete; monitoring confirms whether the assumed likelihood shift actually holds.
Traps that cost marks
- Multiplying ordinal ranks (score 12 versus 15) as though the numbers were ratios; the gap is not a quantity of real risk.
- Setting criteria after assessment to justify a preferred conclusion.
- Treating a completed analysis as a decision; evaluation against criteria is the decision step.
- Assessing too narrow a scope so significant risks fall outside the exercise.