Every organisation runs on decisions made under uncertainty. A new vendor, a cloud migration, a regulatory deadline, a remote workforce. Each one carries a chance of something going wrong, and each one is also a chance to do something better. The discipline that turns that uncertainty into something you can manage is the risk assessment.
This guide explains what a risk assessment actually is, why it sits at the heart of modern compliance and security programs, and how teams move from a blank page to a prioritised list of risks they can act on. By the end you should be able to scope, run and use a risk assessment with confidence and consistency.
- A risk assessment is a structured process to identify, analyse and prioritise risks that could affect your objectives.
- It typically follows five steps: scope, identify, analyse, evaluate and treat or accept.
- Risk can be measured qualitatively, quantitatively, or with a hybrid approach depending on the data available.
- The output is not a document but a decision-making tool used by leadership, IT and audit.
- Most major frameworks, including NIS2, DORA and ISO 27001, expect risk assessment as a continuous activity, not a one-off exercise.
- The quality of the assessment depends on scope, evidence and ownership, far more than on the template you use.
What a risk assessment actually is
A risk assessment is the part of risk management where you systematically identify what could go wrong, analyse how bad it would be and how likely it is, and then decide which risks deserve attention first. ISO 31000, the international standard for risk management, defines it as the overall process of risk identification, risk analysis and risk evaluation. Everything else, treatment plans, controls, audits, reporting, follows from that core process.
The word “risk” itself is worth pausing on. In a security and compliance context, risk is the effect of uncertainty on objectives. It is not the same as a threat (something that could cause harm) or a vulnerability (a weakness that could be exploited). A risk combines a threat, a vulnerability, the likelihood of the event and the impact if it happens. A risk assessment is the exercise that connects those four elements into a picture you can act on.
Why risk assessments matter today
Risk assessment used to be a quiet corner of operations. It is now a board-level concern, and regulators have made it explicit. Under NIS2, DORA, IMO and ISO 27001, organisations are expected to run risk assessments on their assets, processes, suppliers and information systems, and to use the results to drive their security measures. The assessment is no longer a paper exercise; it is the evidence that your controls are proportionate to the risks you actually face.
Beyond regulation, risk assessment is how leadership teams allocate scarce resources. You cannot protect everything equally, and trying to do so usually means protecting the wrong things well and the right things poorly. A good assessment tells you where to spend, where to insure, where to monitor, and where to accept the risk and move on.
The core steps of a risk assessment
Methodologies differ between ISO 27005, NIST SP 800-30 and sector-specific guidance, but the underlying flow is consistent. Most assessments move through five recognisable stages.
- Establish the scope. Define what you are assessing (a system, a process, the whole organisation), the time horizon, and the criteria you will use to judge risk.
- Identify the risks. List the assets and objectives at stake, the threats that could affect them, the vulnerabilities that could be exploited, and the scenarios that emerge.
- Analyse each risk. Estimate the likelihood of each scenario and the impact if it occurs. This can be a scale (low, medium, high), a numeric score, or a monetary figure.
- Evaluate and prioritise. Compare the analysed risks against your risk criteria. Which are tolerable? Which need treatment? Which need urgent attention?
- Decide on treatment. For each risk above tolerance, choose to reduce, transfer, avoid or accept it, and assign an owner and a deadline.
Treatment itself is a separate process, but a risk assessment that does not connect to it is just a list. The link between assessment and treatment is what turns analysis into real risk reduction.
Qualitative vs quantitative approaches
Teams often debate whether to score risks with words, numbers or money. Each approach has trade-offs, and most mature programs use a blended model.
| Approach | What it looks like | Best for |
| Qualitative | Risks rated low / medium / high on likelihood and impact, often in a 5×5 matrix. | Early-stage programs, broad coverage, workshops with non-technical stakeholders. |
| Quantitative | Likelihood expressed as a probability, impact in euros or operational metrics. | Financial services, critical systems, business cases for investment. |
| Hybrid | Qualitative triage of all risks, quantitative deep-dive on the top tier. | Most mid-size organisations under NIS2, DORA or ISO 27001. |
A risk assessment is not an exercise in prediction. It is an exercise in preparation. You will not get every number right, but you will know which fights you have already chosen.
How teams use the results
A finished risk register is only valuable if it changes behaviour. In practice, results flow into several decisions across the business.
- Security teams use the top risks to build the annual control roadmap and prioritise patching, monitoring and testing.
- Procurement and vendor management teams use the supplier-risk view to drive third-party due diligence, contract clauses and continuous monitoring.
- Internal audit uses the register to plan its programme, focusing testing where residual risk is highest after controls.
- Leadership uses the aggregated view for board reporting, insurance decisions and capital allocation, with risk appetite as the guiding reference.
Common pitfalls to avoid
Most risk assessments fail not because of the maths but because of the scoping. Teams either try to assess everything at once and produce a register too big to act on, or they scope so narrowly that the most important risks fall outside the boundary. Defining a clear, justified scope at the start is the single highest-leverage decision.
The second common failure is treating the assessment as a one-off. Risk changes constantly as systems evolve, suppliers rotate and threats shift. A register that is not refreshed at least annually, and after every major change, quickly becomes fiction rather than fact.
The third is ownership. Risks without named owners do not get treated. A clean register lists, for every entry, who is accountable and when the next review is due. Without that, even an excellent analysis ends up as a forgotten spreadsheet.
How to get started
If you are running your first formal risk assessment, start small and end useful. Pick one in-scope system or business process, agree the criteria with leadership, and run the five steps end-to-end. A narrow, finished assessment teaches the team more than a broad, half-finished one and gives you a working template to scale.
From there, the work becomes about cadence and integration: feeding asset inventories, vendor data and incident history into the register automatically, and reviewing it on a schedule everyone agrees to. This is where a compliance platform like StartComply earns its place, by replacing static spreadsheets with a live view of risk that stays current as the business changes around it.
Start Your Compliance Journey Today
Frequently Asked Questions
What is a risk assessment in simple terms?
A risk assessment is a structured way to identify what could go wrong in a given context, analyse how likely and serious each scenario is, and decide which risks need action. It turns vague concerns into a prioritised list that leadership and operational teams can act on.
What is the difference between a risk assessment and risk management?
Risk management is the full discipline of governing, treating and monitoring risk across an organisation. Risk assessment is the specific part of that discipline focused on identifying, analysing and evaluating risks. Every risk management programme contains risk assessments; not every assessment sits inside a mature programme.
How often should a risk assessment be repeated?
At a minimum, annually. In practice, you should also re-run or update the assessment after any significant change: a new system, a major supplier, a serious incident, a regulatory update, or a shift in business strategy. Frameworks such as ISO 27001, NIS2 and DORA expect risk assessment to be continuous rather than a single yearly event.
Who should run the risk assessment?
Risk assessments work best when they are owned by a cross-functional group. Security and compliance teams typically facilitate the process, but input from business owners, IT, legal, procurement and operations is essential. Each identified risk should be assigned a named owner accountable for its treatment.
What is StartComply?
StartComply is a complete compliance platform that helps organisations meet the requirements of NIS2, DORA, IMO and ISO 27001. It combines risk assessment, third-party risk management, control monitoring and certification support in one system, from initial gap analysis through to continuous compliance.
How does StartComply help with risk assessments?
StartComply replaces static spreadsheets with a live risk register linked to your assets, suppliers and controls. It guides teams through scoping, identification, analysis and treatment, keeps evidence audit-ready, and updates the risk picture automatically as your environment changes.
