Risk evaluation is the process of identifying and measuring risk. It is a fundamental business practice that can be applied to investments, strategies, commercial agreements, programs, projects and operations. The following are the basic steps of a risk evaluation process.
All stakeholders are asked to identify risk. This helps to improve acceptance of an initiative as everyone is given an opportunity to express all the things that can go wrong. Sophisticated entities may also identify risks by looking at databases of issues that occurred with similar programs, strategies or projects.
Estimating the probability and impact of each identified risk. This can be done as a rough estimate such as high, medium or low. In reality, most risks don't have a single cost but a probability distribution of possible costs. For example, the risk of a traffic accident isn't a single cost but a range of costs each with an associated probability estimate. Sophisticated entities such as insurance companies will model risks with probability distributions. Projects may estimate risks with a probability-impact matrix.
Listing out the specific conditions that cause the risk to be more likely to occur. For example, the risk of a type of injury at a construction site may be associated with a particular activity or construction stage.