How to Run a Risk Assessment: Process, Methods, and Templates

A risk assessment is the engine of any risk management program. It takes uncertainty and turns it into structured, prioritized, actionable information. Without it, you're guessing which risks matter. With it, you're making decisions based on evidence.

This guide walks through the complete risk assessment process — from scoping through treatment — with practical guidance you can apply whether you're running your first assessment or refining an existing one.

The Risk Assessment Process

Risk assessment follows five sequential phases, each building on the previous one:

1. Scope and Context — What are we assessing?
2. Risk Identification — What could go wrong?
3. Risk Analysis — How likely is it, and how bad would it be?
4. Risk Evaluation — Is this acceptable, or does it need treatment?
5. Risk Treatment — What are we going to do about it?

Phase 1: Define Scope and Context

Before identifying any risks, establish the boundaries:

What's In Scope

• Assets: Systems, data, infrastructure, intellectual property
• Processes: Business operations, workflows, customer-facing services
• Objectives: Strategic goals, compliance requirements, contractual obligations
• Organizational units: Which departments, business lines, or subsidiaries

Assessment Context

• Regulatory requirements: Which frameworks require this assessment (ISO 27001, SOC 2, NIST)?
• Risk appetite: What levels of risk are acceptable?
• Scoring methodology: How will risks be rated (matrix size, scale definitions)?
• Participants: Who needs to be involved in identification and scoring?

Output

A documented scope statement that defines boundaries, methodology, participants, and timeline. Share this with all participants before the assessment begins so expectations are aligned.

Phase 2: Identify Risks

Risk identification is about casting a wide net. Use multiple methods to avoid blind spots.

Workshop-Based Identification

Gather 5-8 participants from diverse functions. For each in-scope area, ask structured questions:

• "What threats could prevent us from achieving this objective?"
• "What has gone wrong in the past 2 years?"
• "What vulnerabilities exist in our current controls?"
• "What external changes could introduce new risk?"

Timebox discussions (15-20 minutes per topic) and capture everything. Consolidate and refine later.

Document Review

Mine existing sources for risk signals:

• Incident reports and post-mortems — what actually happened
• Audit findings — internal and external
• Compliance gap analyses — where controls are missing
• Customer complaints — patterns that indicate systemic issues
• Insurance claims — where losses have occurred

Threat Intelligence

Use external sources to identify risks you haven't experienced yet:

• Industry threat reports (Verizon DBIR, IBM Cost of a Data Breach)
• Regulatory guidance and enforcement actions
• Peer organization incident disclosures
• Framework-specific risk catalogs (NIST, ISO 27005, OWASP)

Writing Clear Risk Descriptions

Every risk should follow the cause-event-consequence pattern:

"Due to [cause/vulnerability], [threat event] could occur, resulting in [business impact]."

Poor Description	Better Description
"Data breach"	"Due to insufficient access controls on customer database, an unauthorized party could exfiltrate customer PII, resulting in regulatory fines, notification costs, and customer churn."
"System downtime"	"Due to single-point-of-failure in primary application server, an infrastructure failure could cause extended service outage, resulting in SLA breach penalties and customer dissatisfaction."
"Compliance risk"	"Due to lack of automated evidence collection, the organization could fail to demonstrate control effectiveness during SOC 2 audit, resulting in qualified opinion and delayed customer deals."

Specific descriptions enable specific treatments. Vague descriptions produce vague responses.

Phase 3: Analyze Risks

Risk analysis assigns severity to each identified risk through scoring.

Qualitative Analysis (Most Common)

Rate each risk on two dimensions using defined scales:

Likelihood: How probable is this risk event in the assessment period (typically 12 months)?

Impact: If the event occurs, how severe are the consequences?

Multiply to get the risk score: Likelihood × Impact.

The key to reliable analysis is defined scales. Every assessor must share the same understanding of what each level means. Provide written definitions with examples for each level, and reference them during scoring sessions.

Scoring Techniques

Individual assessment: Each participant scores independently, then results are compared and discussed. This reduces groupthink and anchoring bias.

Calibrated scoring: Start with a reference risk that everyone agrees on (e.g., "this risk is clearly a Likelihood 3, Impact 4"). Use it as an anchor to calibrate subsequent scores.

Delphi method: Participants score anonymously, results are aggregated, outliers are discussed, and rescoring occurs. Useful for politically sensitive risks.

Common Scoring Pitfalls

Anchoring: The first score suggested dominates discussion. Use individual pre-scoring to prevent this.

Severity inflation: Assessors rate everything as high to ensure resources are allocated. Combat with clear definitions and by emphasizing that over-rating dilutes the signal.

Recency bias: Recent incidents skew perception of likelihood. Use historical data and base rates where available.

Groupthink: The most senior person's opinion prevails. Use anonymous scoring or explicit disagreement protocols.

Quantitative Analysis (For Top Risks)

For your highest-priority risks, quantitative methods provide additional precision:

• Annualized Loss Expectancy (ALE) = Annual Rate of Occurrence × Single Loss Expectancy
• Monte Carlo simulation — run thousands of scenarios to produce probability distributions of potential loss
• Value at Risk (VaR) — the maximum expected loss at a given confidence level over a time period

Quantitative analysis requires more data and expertise but produces financial estimates that resonate with CFOs and board members.

Phase 4: Evaluate Risks

Evaluation compares analyzed risks against your risk appetite and tolerance thresholds to determine which require treatment.

Prioritization Matrix

Plot all scored risks on your risk matrix. This produces a heat map showing the distribution of risk severity across the portfolio.

Decision Rules

For each risk level, apply consistent decision rules:

Risk Level	Score Range	Decision
Critical	21-25	Immediate treatment required. Executive escalation.
High	15-20	Active treatment required. Risk committee oversight.
Medium	6-12	Treatment plan required. Owner-managed.
Low	1-5	Monitor. Accept or implement basic controls.

Appetite Comparison

Compare each risk's residual score against the tolerance threshold for its category. Risks exceeding tolerance require either additional treatment or formal acceptance with documented rationale and leadership sign-off.

Phase 5: Risk Treatment

For each risk requiring treatment, select and document a strategy:

Treatment Options

Mitigate — Implement controls to reduce likelihood, impact, or both. This is the most common treatment for risks within the organization's control.

Transfer — Shift the risk to a third party (insurance, outsourcing, contractual allocation). Appropriate when another party can absorb the risk more efficiently.

Avoid — Eliminate the activity or exposure that creates the risk. Appropriate when the risk is unacceptable and no treatment can reduce it sufficiently.

Accept — Acknowledge the risk and take no additional action. Only appropriate when the residual risk is within appetite and the cost of treatment exceeds the benefit.

Treatment Plans

For mitigated risks, document:

• Specific controls or actions to be implemented
• Responsible owner for each action
• Target completion date
• Expected risk reduction (target residual score)
• Success criteria — how will you know the treatment is working?

Making Assessments Repeatable

A risk assessment provides the most value when it's part of an ongoing program, not a one-time project.

Establish Cadence

• Full assessment: Annually (or when significant changes occur)
• High/Critical risk reassessment: Quarterly
• Trigger-based reassessment: After incidents, regulatory changes, or organizational shifts

Standardize the Process

• Use the same scoring methodology and definitions across all assessments
• Maintain a risk register that carries forward from assessment to assessment
• Track risk trends over time (is this risk increasing, stable, or decreasing?)
• Document the assessment methodology so it's repeatable by anyone, not dependent on one person

Integrate with Your GRC Platform

Move from documents and spreadsheets to a platform that:

• Maintains the risk register with historical scores and trends
• Automates review reminders based on risk level
• Links risks to controls, actions, and compliance frameworks
• Generates dashboards and reports for leadership
• Provides an audit trail of all changes

The goal is a living risk assessment program where insights flow continuously into decision-making — not a binder that sits on a shelf until the next audit.