Risk assessment is the systematic way of finding, analysing and ranking the things that could hurt a business, project or process. This guide covers the main techniques, when each fits and the five steps to follow.
What risk assessment is
Risk assessment means identifying hazards, analysing the risks they create and deciding how to remove or control them. It answers three questions: what can go wrong, how likely is it, and how bad would it be. It is used in business management, finance, healthcare, engineering, construction, IT and project management, and it is a core part of audit planning.
Why it matters
- It prevents financial loss.
- It improves decisions.
- It makes workplaces safer.
- It reduces uncertainty on projects.
- It supports regulatory compliance.
- It protects reputation.
Finding risks early gives you time to prepare a response before the cost arrives.
Choosing a technique
The right method depends on the type of risk and how much detail you need.
Qualitative assessment
Risks are ranked by severity and likelihood using labels such as low, medium and high, based on expert judgement. It is simple and cheap and suits small projects. For example, strong market competition might be rated high and staff turnover medium.
Quantitative assessment
Uses numbers and statistical models to measure the probability and the financial impact of a risk, for example the chance of a project delay and what it would cost. It gives measurable results and suits large projects and financial analysis.
Risk matrix
A grid that plots likelihood against impact, so risks can be prioritised at a glance. It is easy to understand and widely used in project management.
SWOT analysis
Looks at strengths, weaknesses, opportunities and threats. The threats and weaknesses are treated as potential risks.
Failure mode and effects analysis (FMEA)
Lists possible failures, their causes and effects, and gives each a risk priority number. It is common in manufacturing and engineering.
Hazard identification (HAZID)
A brainstorming method for finding hazards, used in oil and gas, construction and chemical plants.
Hazard and operability study (HAZOP)
A structured, team-based method that looks at deviations from normal operation and weak points in a design.
Checklist method
Uses predefined lists built from past experience and industry standards. It is quick and unlikely to miss common risks, but it can miss unusual ones.
The five steps
1. Identify the risks. 2. Analyse them. 3. Evaluate and prioritise. 4. Decide on controls. 5. Monitor and review.
In audit and compliance
Auditors use risk assessment to decide where to test most, and finance teams use it to spot weak controls before they cause errors. If you want an independent view of your own risks, see our audit and assurance service.
Key takeaways
- Risk assessment asks what can go wrong, how likely it is and how bad it would be.
- Qualitative methods rank risks by judgement, quantitative ones measure them with numbers.
- Follow five steps: identify, analyse, prioritise, control, monitor.
Frequently asked questions
What is the difference between qualitative and quantitative risk assessment?
Qualitative ranks risks with descriptive labels using expert judgement. Quantitative measures probability and cost with numerical data.
Which technique is best for a small business?
A qualitative approach with a simple risk matrix is usually enough. It is quick, low cost and easy to repeat each year.
How often should risks be reviewed?
At least once a year, and whenever something significant changes such as a new product, a new market or a new regulation.
Talk to a chartered accountant
Questions about your own situation? Reach us directly and we will reply with clear next steps.
This article is general information and not advice for your specific circumstances. Rules and thresholds change, so confirm the current position before you act.
