Glossary term
Risk Identification
Subject: Risk Management, Risk Fundamentals and Frameworks
Risk identification is the first stage of risk management: spotting what could go wrong, or unexpectedly go right, for an organisation's goals and recording each item clearly enough to act on.
Explanation
Methods include workshops, interviews, process walkthroughs, checklists, reviews of past incidents and audit findings, loss data, scenario exercises and horizon scanning. Good practice starts from objectives and asks what could prevent them. Each risk is written as a clear statement of cause, event and consequence, for example: because the supplier relies on one plant, a fire could halt production for weeks. Vague entries such as “bad IT” cannot be rated or owned. Identified risks go into the risk register with an owner. The step is repeated regularly because the business changes, and it covers risks whose causes the firm does not control. A risk that is not identified is, by default, unmanaged and unreported. Every later step works only on what this one produced, so a blind spot here stays a blind spot throughout.
Example
A university runs a half-day workshop with its estates, finance, IT and student services teams. Asked what could stop it enrolling students on time, staff name a payment system outage, visa delays and the loss of key admissions staff. Each is written as a cause, event and consequence statement, given an owner and entered on the register.
Not to be confused with
- Risk Assessment
- Assessment includes identification, analysis and evaluation; identification only finds and describes the risk.