Assessment Guidance - Risk process - Identify, rate and control measures

Sep 2, 2026

Assessment Guidance for managing organizational risks, focusing on a structured risk process. The guidance explains how to determine impact and likelihood using provided tables, then calculate a risk rating by multiplying these values and referencing a colored risk matrix. It specifies decision rules by residual risk color: green requires no extra controls, amber requires continuing only with additional controls to reduce risk to ALARP, and red requires stopping until controls reduce risk to ALARP. Control measures should follow the risk hierarchy, with proportional consideration of implementation cost.

LanguageEnglish

CategoryForms

FormatDOCX

Pages16

Reading Time6 min

AccessFree to download

Risk process

Identify impact and likelihood

Calculate risk rating using the matrix

Select actions based on residual risk color

FAQs

How is the risk rating calculated in this guidance?

First identify impact and likelihood using the tables above, then multiply Impact by likelihood and use the colored matrix to determine the risk rating.

What should be done when the residual risk is green?

If the residual risk is green, additional controls are not necessary.

When must an activity stop due to risk level?

If the residual risk is red, the activity must not continue until additional controls are implemented and the risk is reduced to an acceptable level.

Sep 2, 2026

Upload by Emma Mercer