Risk Assessment Table
ready.gov/business
(1) (2) (3) (4) (5) Impacts with Existing Mitigation (L, M, H) (11)
Asset or Operation Hazard Senario Oportunities for Probability Overall
at Risk (Location, Timing, Prevention (L, M, H)
(6) (7) (8) (9) (10)
Hazard Rating
People Property Operations Environment Entity
Magitude) or Mitigation
Risk Assessment Table
INSTRUCTIONS
Column 1: Compile a list of assets (people, facilities, machinery, equipment, raw materials, finished goods, information technology, etc.)
in the left column.
Column 2: For each asset, list hazards (review the “Risk Assessment” page from Ready Business) that could cause an impact. Since
multiple hazards could impact each asset, you will probably need more than one row for each asset. You can group assets together as
necessary to reduce the total number of rows, but use a separate row to assess those assets that are highly valued or critical.
Column 3: For each hazard consider both high probability/low impact scenarios and low probability/high impact scenarios.
Column 4: As you assess potential impacts, identify any vulnerabilities or weaknesses in the asset that would make it susceptible to loss.
These vulnerabilities are opportunities for hazard prevention or risk mitigation. Record opportunities for prevention and mitigation in
column 4.
Column 5: Estimate the probability that the scenarios will occur on a scale of “L” for low, “M” for medium and “H” for high.
Columns 6-10: Analyze the potential impact of the hazard scenario in columns 6 - 10. Rate impacts “L” for low, “M” for medium and “H”
for high.
Column 8: Information from the business impact analysis should be used to rate the impact on “Operations.”
Column 10: The “entity” column is used to estimate potential financial, regulatory, contractual, and brand/image/reputation impacts.
Column 11: The “Overall Hazard Rating” is a two-letter combination of the rating for “probability of occurrence” (column 5) and the
highest rating in columns 6 – 10 (impacts on people, property, operations, environment, and entity).
Carefully review scenarios with potential impacts rated as “moderate” or “high.” Consider whether action can be taken to prevent the
scenario or to reduce the potential impacts.
ready.gov/business

I would like to add a caveat to the matrix style of assessment.

The methodology fails with high consequence hazards in low likelihood occurrence areas

If a risk is seen as life threatening it should always be graded as high (16 in the example above) if it can happen, whatever the chance of occurrence.

I cannot countenance risk assessing something that can kill without putting into place any and all accommodations that will reduce that risk level.

Rational risk assessment is very interesting, but can anyone cite a real life instance where it made a difference?