A few lifetimes ago I did risk analysis in a medical environment. The link below provides a reasonably easy to understand process that can be adapted to other situations.

The spreadsheet provides a comprehensive view of both the risks and mitigation's for a given threat matrix. It gives a fairly broad image of the issues in the medical world, but also suggests threats and mitigation's common to most threats.

I believe it is posted in the public domain as I found it with a google search.

I have used this system in communications (Grid Down Comms) planning as well as several other areas. It is a bit complex but therein is it's strength. Spend a morning with it and you will understand both the process and your particular threat situation.


edit: I had a long url here but it did not work. Probably because of the formatting.

instead google
Kaiser Hazard Vulnerability Analysis


Nomad.