Introduction

Once the context within which risks are being analysed is clear, and full risk taxonomy available, it is time to start identifying risks. The point of the risk identification process is to decide which of the many risks that might affect an organisation are currently doing so, or may do so in future. Part of the risk identification process also involves determining the way in which risks will then be analysed, in particular whether a qualitative or quantitative approach will be used. These, and other factors, are included in a risk register, discussed later in this chapter.

Risk identification should be done as part of a well-defined process. This ensures not only that as many risks as possible are identified, but also that they are properly recorded.

There are four broad areas to risk identification. The first concerns the tools that can be used, whilst the second concerns the ways in which the tools are employed. Identification also includes an initial assessment of the nature of the risk, and also the way in which the risk is recorded. Each of these aspects is discussed in turn.

Risk identification tools

In this section, a range of potential risk identification tools are discussed. These can generally by used in a number of ways and simply describe the starting point for the generation of ideas. Some common tools are described below.