Techniques of Risk Assessment
Techniques of Risk Assessment
The risk assessment process flow outlined in the international standards on risk management (ISO 31000:2009) and
on risk assessment (31010:2009) is the most commonly used . It starts with setting the context and then 12 consists of
three steps: risk identification, risk analysis and risk evaluation. This process flow is the basis for most European
assessments and for the Australian national risk assessment guidelines and some others. Below is a description of
each component of the process, cross-referencing the elements in the Guidelines that cover that step.
Establishing context: This step is concerned with understanding the risk management context in order to define the
purpose and scope of the risk assessment. It includes engaging and consulting with stakeholders and defining criteria
for decisions. In the Guidelines, establishing context starts in element 1 and is then completed with policy and
technical scoping in element 2.
Risk identification: From a national disaster risk assessment perspective, this step is concerned with a very high-
level scoping of hazard, exposure and vulnerabilities to define the direction for the rest of the assessment process. It
uses the knowledge and experience of stakeholders, data on past disasters and risk information to draw initial
conclusions about the importance of a specific hazard, assets, known vulnerabilities and major impacts of concern for
an NDRA. Consideration should be given to both extensive (frequent, lowimpact) and intensive (occasional, high-
impact) events, as well as potential cascading events and simultaneous events linked to the same cause (e.g. El Niño
and La Niña). Disaster risk identification starts in element 2 and is then completed with more technical depth in
element 6.
Risk analysis: This step is concerned with obtaining a more detailed understanding of the disaster risk: detailed
hazard analysis, exposure analysis, vulnerability analysis and capacity analysis. The analysis provides insight into the
interaction of a single hazard or a multi-hazard with the exposure and all dimensions of vulnerabilities (physical,
environmental, social, economic and cultural). Each point of interaction of disaster risk components creates a unique
coupling: a specific impact and its likelihood.
Another component of risk analysis is understanding and evaluating the effectiveness of the existing capacities (or the
controls and measures in place for managing the risk, as this is called in ISO:31010). Understanding the effectiveness
of capacities is critical for identifying targeted measures to manage the risk. Risk analysis also includes assessing the
confidence level or the level of uncertainty. This is relevant for both single-hazard and multi-hazard disaster risk
analysis, with any time-horizon. Risk analysis is covered in elements 6 and 7.
Risk evaluation: This step allows for risk prioritization for the purpose of managing the risk. The multi-hazard
disaster risks analysed for likelihood and impact could be presented in different ways to facilitate the visualization and
prioritization process. The risk prioritization is further adjusted based on an understanding of capacities, risk
perception and risk acceptance of the whole 13 of a country’s society, and by the availability and level of resources to
manage the risks. This requires input from those owning the risk and who are responsible for disaster risk
management. The whole of society is represented through stakeholder coordination and communication mechanisms
to define the priority disaster risks. Only then is there a legitimate basis for disaster risk prioritization – defining the
risks of high societal importance that require immediate attention, the risks that could be tolerated or neglected, and
the risks that need to be closely monitored. Risk evaluation is covered in elements 8 and 9.
BASIS OF RISK ASSESSMENT:
•Identify hazards: Identify potential risks and hazards in a workplace, such as physical dangers or chemical
exposures
•Risk evaluation: Determine the probability of a risk and the severity of its potential consequences
•Quantitative risk assessment: Use data and numbers to measure the probability and impact of risks
•Qualitative risk assessment: Systematically examine what could cause harm to people in the workplace
•Record findings: Document the results of the risk assessment to ensure risks are managed systematically
•Risk matrix: Assess the likelihood and severity of risks, and classify them by order of importance
RISK ASSESSMENT TOOLS AND TECHNIQUES
There are options on the tools and techniques that can be seamlessly incorporated into a business’ process. The four
common risk assessment tools are:
• Risk Matrix,
• Decision Tree,
• Failure Modes and Effects Analysis (FMEA), and
• Bowtie Model.
A risk matrix is often used to measure the level of risk by considering the consequence/ severity and likelihood of
injury to a worker after being exposed to a hazard. Two key questions to ask when using a risk matrix should be:
1.Consequences: How bad would the most severe injury be if exposed to the hazard?
2.Likelihood: How likely is the person to be injured if exposed to the hazard?
The most common types are the 3×3 risk matrix, 4×4 risk matrix, and 5×5 risk matrix.
How to Assess Consequences?
It is common to group the injury severity and consequence into the following four categories:
•Fatality – leads to death
•Major or serious injury – serious damage to health which may be irreversible, requiring medical attention and
ongoing treatment
•Minor injury – reversible health damage which may require medical attention but limited ongoing treatment). This
is less likely to involve significant time off work.
•Negligible injuries – first aid only with little or no lost time.
It is common to group the likelihood of a hazard causing worker injury into the following four categories:
•Very likely – exposed to hazard continuously.
•Likely – exposed to hazard occasionally.
•Unlikely – could happen but only rarely.
•Highly unlikely – could happen, but probably never will.
We recommend OSHA’s great learning resources in understanding how to assess consequence and likelihood in your
risk assessments.
A "decision tree" in disaster risk assessment is a graphical tool used to analyze potential outcomes of a disaster by
mapping out different decision pathways based on various factors like hazard type, exposure level, vulnerability,
and mitigation strategies, allowing risk managers to evaluate the most likely scenarios and choose the most
effective response options depending on the unfolding situation.
•Visual representation:
•The decision tree is structured like a tree with branches splitting at each decision point, representing different
possible actions or conditions that could occur during a disaster.
•Decision nodes:
•These are points in the tree where a choice needs to be made based on available information, like whether to
evacuate or reinforce infrastructure.
•Chance nodes:
•These represent uncertain events with probabilities assigned to each potential outcome, such as the likelihood of a
flood reaching a certain severity.
•Outcomes:
•At the end of each branch, the decision tree shows the potential consequences of a chosen pathway, including the
How to use a decision tree in disaster risk assessment:
10.Based on the analysis, identify the most effective mitigation or response strategies to
minimize potential damage and loss.