How to identify risks? - SilverBulletRisk

• Threat – the source of the risk event that causes uncertainty.
• Risk exposures – the amount that theoretically is at risk if the threat becomes a reality.
• Risk – the collection of threats/causes and exposures that are treated and managed as a single whole.
• Risk levels – risk level indicates how serious the risk is.

Identifying as many risks as possible often leads to not being able to manage it all properly.

• First, identify the risks with the largest potential loss or financial impact. Then collect smaller risks together that can be managed as a group. Smaller risks have minor financial consequences.
• Risk should not ‘overlap.’ It could lead to the wrong results.
• Avoid too vague risks.
• Lack of imagination. Major disasters are the unimaginable ones that have never happened before. You can always dismiss it later if rigorous analyses show that the risk is unrealistic.

One method is to ask the people with knowledge about the functioning of the organization, what could go wrong. It can be done using brainstorming, questionnaires, self-reporting etc.