5.1 What is Risk Assessment

Risk Assessment is the process of identifying, analyzing and evaluating risk. Risk assessment must be systematic, iterative and collaborative, using the stakeholders’ knowledge. It should be based on the most recent information and supported by further research as required.

1. Risk Identification. This is the process of finding, recognizing, and describing potential risks that can support or threaten a project’s achievement of its objectives (ISO, 2018). The project team should use a wide range of techniques to identify risks which affect one or more objectives.
2. Risk Analysis. This is a comprehensive analysis of risk, based on its characteristics (ISO, 2018). This involves considering risks, sources, consequences, likelihood, triggers, contingencies, controls and control effectiveness. A key consideration is risk exposure, which refers to the risk likelihood and consequence levels. A risk can have numerous causes and consequences and affect multiple objectives or goals.
3. Risk Evaluation. This process is used to support decision-making. It involves comparing the results of the risk analysis process to the pre-defined risk criteria, which outlines when further action is required (ISO, 2018). This can lead to a decision to transfer, avoid, treat/mitigate, approve, or reject.(Reaiche et al., 2022).

Importance of Risk Assessment

Risk assessment is the foundation of a strong Enterprise Risk Management (ERM) program. It’s the first step in understanding the potential threats an organization faces. Here’s why risk assessment is so crucial:

• Identify threats: Risk assessment helps uncover potential issues, both internal (e.g., process breakdowns) and external (e.g., economic shifts).
• Prioritize effectively: Risk assessment helps categorize threats based on likelihood and impact, allowing resources to be focused on the most critical issues.
• Informed decision-making: With a clear understanding of risks, one can make better choices about resource allocation, strategic direction, and risk mitigation strategies.
• Proactive approach: Identifying risks early can avoid them altogether or lessen their impact. This proactive approach can save an organization time, money, and reputation.
• Regulatory compliance: Many industries have regulations requiring organizations to have a risk management plan. A strong risk assessment is a key component of demonstrating compliance.

Risk assessment is the cornerstone of a successful ERM program. It provides the information required to make informed decisions, protect the organization, and achieve goals.

Risk Assessment Approaches

There are two approaches for assessing risks: top-down and bottom-up. Both approaches are strategies for conducting risk assessments, but they differ in where the assessment process starts and who is involved. Apart from the starting point, they have different focuses, advantages, and disadvantages. Risks associated with strategies can be assessed more effectively when approached through a top-down approach, whereas, for hazard and operational risk, a bottom-up approach may give better results.

Top-Down Approach

This approach starts with senior management or executives identifying and assessing risks that could impact the organization’s overall strategic objectives and goals. This approach focuses on high-level, enterprise-wide risks such as strategic, financial, operational, and reputational risks.

The top-down approach ensures that risk management is aligned with the organization’s strategic direction and priorities. It provides a comprehensive view of risks that could significantly impact the entire enterprise (Howell, 2024).

Bottom-up Approach

The bottom-up approach involves identifying and assessing risks at the operational or functional levels of the organization, such as individual projects, processes, departments, or business units. This approach relies on input from employees closest to the day-to-day operations, who have first-hand knowledge of potential risks in their respective areas. For example, project, process, compliance, and health and safety risks.

The bottom-up approach ensures that risk management is grounded in the realities of the organization’s operations and captures risks that may not be visible at the higher levels (Howell, 2024).

Combining Top-Down and Bottom-Up Approaches

Most organizations recognize the importance of using top-down and bottom-up approaches in risk management practices. The top-down approach provides a strategic perspective, while the bottom-up approach offers a granular, operational view. By combining these approaches, organizations can comprehensively understand risks at all levels and develop effective risk mitigation strategies. The integration of top-down and bottom-up approaches can be facilitated through establishing a risk management culture that encourages collaboration and information sharing across all levels.

By adopting a holistic approach that incorporates both top-down and bottom-up perspectives, organizations can effectively identify, assess, and manage risks, ultimately enhancing their ability to achieve their strategic objectives while minimizing potential negative impacts (Howell, 2024).