Risk Assessment
Risk assessment turns vague worry into prioritized actions: what can go wrong, how bad, what we do now, and who owns follow-up.
When to Offer This Workflow
Trigger conditions:
- Major launch, migration, or new vendor
- Steering or audit requests a risk matrix
- Post–near-miss prevention work
Initial offer:
Use six stages: (1) scope & stakeholders, (2) identify risks, (3) analyze likelihood & impact, (4) plan mitigations, (5) owners & deadlines, (6) review & tracking). Confirm scoring approach (simple matrix vs quantitative).
Stage 1: Scope & Stakeholders
Goal: Define system/project boundary and who can accept residual risk (product, eng, legal).
Exit condition: RACI or explicit approvers for go/no-go.
Stage 2: Identify Risks
Goal: Brainstorm across categories: technical, security, operational, legal, reputational, financial.
Practices
- Pre-mortem: “It failed because…” exercise for alignment
Stage 3: Analyze
Goal: Score likelihood and impact with a shared rubric; avoid false precision.
Stage 4: Plan Mitigations
Goal: Prevent, detect, and respond controls; rough cost/time per mitigation.
Stage 5: Owners & Deadlines
Goal: Each material risk has an owner and date; escalation path if unmitigated by launch.
Stage 6: Review & Tracking
Goal: Living RAID log; revisit after scope changes or incidents.
Final Review Checklist
- Scope and decision authority clear
- Risks span relevant categories
- Scoring applied consistently
- Mitigations have owners and dates
- Residual risk explicitly accepted or deferred with plan
Tips for Effective Guidance
- Distinguish future risk from current defects.
- For security-heavy systems, align with threat (threat modeling) outputs.
- Startups: fewer rows, more honesty on top existential risks.
Handling Deviations
- Regulated industries: follow required RA templates when mandated.