Governance, Law & Compliance
Risk assessment
A structured process for identifying possible harms, likelihoods, and consequences.
Example
A risk assessment identifies possible harms, their likelihood, and planned controls.
Why it matters
It helps teams prioritize safeguards before spending effort on the wrong problems.
You'll hear it
“Which failure would hurt someone most, even if it happens rarely?”
Can you control it?
Yes
Yes. An organization can put a risk assessment in place through its policies, processes, records, training, or oversight structure. Individual users may participate without controlling the entire program.
Common questions
- Should only technical failures be considered?
- No. Misuse, confusing instructions and poor human decisions can create risks too.
- Can a low-probability risk still deserve attention?
- Yes. A rare event can matter greatly when its consequences are severe.
- When should the assessment be revisited?
- After meaningful changes, incidents or new evidence that could alter the earlier judgment.