Fundamentals of Risk Management

Risk assessment
122
Risk assessment techniques
There is a wide range of risk assessment techniques available, and International 
Standard ISO/IEC 31010 ‘Risk Management: Risk Assessment Techniques’, was
published in 2009. This standard provides detailed information on the full range of 
risk assessments techniques that can be used. Table 10.3 lists the main risk assess-
ment techniques that are in common use and also provides a brief description of 
each of these techniques. Probably the most common risk assessment approaches are 
the use of checklists/questionnaires and the use of brainstorming sessions, normally 
during risk assessment workshops.
Checklists and questionnaires have the advantage that they are usually simple to 
complete and are less time-consuming than other risk assessment techniques. 
However, this approach suffers from the disadvantage that any risk not referenced 
by appropriate questions may not be recognized as significant. A simple analysis
of the advantages and disadvantages of each of the most common risk assessment 
techniques is set out in Table 10.4.
Given that risks can be attached to other aspects of an organization as well as or 
instead of objectives, a convenient and simple way of analysing risks is to identify the 
key dependencies faced by the organization. Most people within an organization will 
be able to identify the aspects of the business that are fundamentally important to its 
future success. Identifying the factors that are required for success will give rise to a 
list of the key dependencies for the organization.
TAbLE 
10.2
Bottom-up risk assessment
advantages 
Disadvantages 
Significant buy-in at all levels of the 
organization should be achieved 
There will be little focus on external 
risks or strategic risks 
Can be mirrored to an existing 
organization chart and risk impacts 
beyond immediate operational
risks can be discussed 
Time-consuming and may demotivate,
if it takes longer to develop the overall 
enterprise results 
Operational staff have great
awareness of local risks and their 
causes, which might elude higher
levels of management 
Danger that the approach becomes too 
detailed and blinkered, resulting in a silo 
approach to risk assessment 
Methodology can be varied according to 
local norms and culture and this is useful 
for a multinational organization 
New risks emerging from the operational 
activities of the business might not be 
reported by operational staff 

---