Glossary term
Risk Analysis
Subject: Risk Management, Risk Fundamentals and Frameworks
Also known as: Risk estimation
Risk analysis is the step of working out how likely an identified risk is, how large its consequences could be and what drives both, so that risks can be compared and ranked.
Explanation
It follows risk identification and comes before evaluation, where results are weighed against appetite. Analysis can be qualitative, using descriptive scales such as low, medium and high; semi-quantitative, using scores on a numeric scale; or quantitative, using loss data, probabilities and models such as Monte Carlo simulation. Analysts look at causes, existing controls, how fast the risk could materialise and whether several risks are linked. Quality depends on the data and on honest judgment, so results are often challenged in workshops. The output feeds a risk matrix or register. People sometimes use the term for the whole assessment, but strictly it is one step inside risk assessment. Treatment budgets follow these ratings, so a miscalibrated likelihood sends money to the wrong risk.
Example
A pharmaceutical manufacturer has listed single-source supply of a key ingredient as a risk. The team estimates that a supplier failure could happen about once in ten years and halt production for six weeks. They check stock levels and how long a second supplier would need to qualify, then rate impact high and likelihood medium on the register.
Not to be confused with
- Risk Assessment
- Risk assessment is the whole sequence of identification, analysis and evaluation; analysis is only the middle step.