QUEENSLAND GOVERNMENT

RISK MANAGEMENT

TRAINING PROGRAM

STEP 3 - ANALYSE THE RISK

© The State of Queensland 2003

Copyright protects this publication. Except for purposes permitted by the Copyright Act 1968, reproduction,
adaptation, electronic storage and communication to the public is prohibited without prior written permission. To
obtain express permission, contact the Department of the Premier and Cabinet.

Edition: February 2003

Contents

STEP 3 – ANALYSE THE RISK .............................................................................................. 1

Calculating the level of risk ................................................................................................... 1

Defining the level of risk........................................................................................................ 2
Sample case study 3 ............................................................................................................... 4
Application case study 3 ........................................................................................................ 5
Summary ................................................................................................................................ 6
Feedback on application case study 3 .................................................................................... 7
Risk Analysis Instruction Sheet ............................................................................................. 8
Risk Analysis Form................................................................................................................ 9
Glossary................................................................................................................................ 10
RISK MANAGEMENT STEP 3 - ANALYSE THE RISK

STEP 3 – ANALYSE THE RISK

After you have completed Steps 1 and 2 to establish the context of risk management and
identify the risks, assess the impact of these risks. You want to separate minor acceptable
risks from major risks which must be managed.

This involves deciding on the relationship between the likelihood (frequency or probability)
and the consequences (the impacts) of the risks you have identified. The level of risk should
be analysed in relation to what you are currently doing to control that risk. Control measures
decrease the level of risk, but there may be sufficient risk remaining for the risk to be
considered with others.

For example, the risk control measure for a wet, slippery floor may be to put up a sign
warning customers about it. There is still a risk remaining that a customer may slip on the
floor.

Calculating the level of risk

Consult with others and use your experience and the table below to calculate the level of risk.

1 Evaluate the likelihood of a risk occurring, according to the ratings in the left-hand
column.

2 Evaluate the consequences if the incident occurred, according to the ratings in the top
row.

3 Calculate the level of risk by finding the intersection between the likelihood and the
consequences.

Consequences

Likelihood Insignificant Minor Moderate Major Catastrophic

Almost certain High High Extreme Extreme Extreme

Likely Moderate High High Extreme Extreme
Possible Low Moderate High Extreme Extreme
Unlikely Low Low Moderate High Extreme
Rare Low Low Moderate High High

(Adapted from Australian/New Zealand Standard for Risk Management AS/NZS 4360:1999)

For example: A risk which is likely to occur and has minor consequences poses a high level
of risk.

February 2003 Page 1

RISK MANAGEMENT STEP 3 - ANALYSE THE RISK

Defining the level of risk

Once you find the intersection between the likelihood and the consequences, you have
determined the level of risk. What does it mean in terms of treating the risk?

Extreme An extreme risk requires immediate action as the potential could be

devastating to the organisation.

High A high level of risk requires action, as it has the potential to be damaging to
the organisation.

Moderate Allocate specific responsibility to a moderate risk and implement monitoring

or response procedures.

Low Treat a low level of risk with routine procedures.

! The consultation process is important in analysing the risk. You need to confirm
your perception of the likelihood (frequency or probability) and the
consequences (the impacts) of a risk with others.

February 2003 Page 2

RISK MANAGEMENT STEP 3 - ANALYSE THE RISK

! Documenting Step 3 – Analyse the risks

At the end of Step 3 Analyse the risks, you should have the following documents:

• A table showing all risks, their existing controls if applicable, the likelihood of their
occurring, their consequences and the subsequent level of risk.

Use Risk Analysis Form (page 9).

February 2003 Page 3

RISK MANAGEMENT STEP 3 - ANALYSE THE RISK

Sample case study 3

In developing their risk management strategy for the Falls State Forest Park, the
Government’s Forestry Department analysed the use of the Park and established the
following:

• Three of the persons killed or injured were overseas visitors.

• Many visitors wanted to get as close as possible to the falls to photograph them or
watch the water cascading over the drop.

• Swimming in the rock pools was a popular activity.

• Rocks by the waterfall were often extremely slippery from the constant spray
drift.

• Pools, downstream from the waterfall, were suitable for swimming and were
surrounded by dry granite rocks.

In view of this information, they decided that the risks which they identified had the
following levels of risk.

Risk Likelihood Consequences Level of risk

1 People slipping on the rocks Likely Major High
2 People diving and striking the
Possible Catastrophic Extreme
rocks
3 Trees and plants damaged by
Possible Minor Moderate
visitors
4 People going to unsafe parts of
Likely Major High
the Falls.

It was decided that Risk 2 required immediate action, Risks 1 and 4 required action
and Risk 3 could be treated by routine procedures.

February 2003 Page 4

RISK MANAGEMENT STEP 3 - ANALYSE THE RISK

Application case study 3

Read the following and then answer the questions which follow.

A survey carried out by Nautilus Boat Hire revealed that a significant number of
clients are tourists from interstate or overseas. Most clients are once-only hirers who
have no knowledge of local waters and weather conditions.

1 Write the most appropriate answer for each of the five risks listed below. Use the risk
calculation table to identify the level of risk.

Likelihood Consequences Level of risk

(Almost certain, (Catastrophic, Major,
Risk (Extreme, High,
Likely, Possible, Moderate, Minor,
Moderate, Low)
Unlikely, Rare) Insignificant)
1 Houseboat and runabout
clients get lost and/or
stuck on sandbanks
2 Clients find the houseboats
very difficult to control in
high winds
3 Runabout clients are
sunburned and dehydrated
on hot, sunny days
4 The maps provided
frequently getting wet and
becoming unreadable
5 Clients losing personal
property overboard

2 Tick the most appropriate option in terms of treating the following levels of risk.

Level of risk Risk treatment option

Extreme " Requires immediate action
" Requires action
" Allocate specific responsibility
" Treat by routine procedures
Moderate " Requires immediate action
" Requires action
" Allocate specific responsibility
" Treat by routine procedures
High " Requires immediate action
" Requires action
" Allocate specific responsibility
" Treat by routine procedures

February 2003 Page 5

RISK MANAGEMENT STEP 3 - ANALYSE THE RISK

Summary
When you analyse the risks of an activity, ask yourself the following questions:

In relation to each risk:

• Are there any controls currently in place to manage the risk?

• If so, is there any remaining risk?

• What is the likelihood of the risk occurring?

• What are the consequences if the risk should occur?

• Therefore, what is the level of the risk?

February 2003 Page 6

RISK MANAGEMENT STEP 3 - ANALYSE THE RISK

Feedback on application case study 3

1 Write the most appropriate answer for each of the five risks listed below. Use the risk
calculation table to identify the level of risk.

Likelihood Consequences Level of risk

(Almost certain, (Catastrophic, Major,
Risk (Extreme, High,
Likely, Possible, Moderate, Minor,
Moderate, Low)
Unlikely, Rare) Insignificant)
1 Houseboat and runabout Likely Moderate High
clients get lost and/or
stuck on sandbanks
2 Clients find the Possible Major Extreme
houseboats very difficult
to control in high winds
3 Runabout clients are Likely Moderate Extreme
sunburned and dehydrated
on hot, sunny days
4 The maps provided Likely Major Extreme
frequently getting wet and
becoming unreadable
5 Clients losing personal Possible Minor Moderate
property overboard

2 Tick the most appropriate option in terms of treating the following levels of risk.

Level of risk Risk treatment option

Extreme " Requires immediate action #
" Requires action
" Allocate specific responsibility
" Treat by routine procedures
Moderate " Requires immediate action
" Requires action
" Allocate specific responsibility #
" Treat by routine procedures
High " Requires immediate action
" Requires action #
" Allocate specific responsibility
" Treat by routine procedures

February 2003 Page 7

RISK MANAGEMENT STEP 3 - ANALYSE THE RISK

Risk Analysis Instruction Sheet

INSTRUCTIONS:

1 Evaluate the likelihood of a risk occurring according to the ratings in the left-hand
column.

2 Evaluate the consequences if the incident occurred according to the ratings in the top
row.

3 Calculate the level of risk by finding the intersection between the likelihood and the
consequences.

CONSEQUENCES

LIKELIHOOD Insignificant Minor Moderate Major Catastrophic

Almost certain High High Extreme Extreme Extreme

Likely Moderate High High Extreme Extreme
Possible Low Moderate High Extreme Extreme
Unlikely Low Low Moderate High Extreme
Rare Low Low Moderate High High

(Australian/New Zealand Standard for Risk Management AS/NZS 4360:1999)

KEY:

Extreme An extreme risk requires immediate action as the potential could be

devastating to the organisation.

High A high level of risk requires action, as it has the potential to be damaging to
the organisation.

Moderate Allocate specific responsibility to a moderate risk and implement monitoring or

response procedures.

Low Treat a low level of risk with routine procedures.

February 2003 Page 8

RISK MANAGEMENT STEP 3 - ANALYSE THE RISK

Risk Analysis Form

To be used in conjunction with Risk Analysis Instruction Sheet (Step 3 – Analyse the risks)

Likelihood of risk Consequences

Level of risk
Identified risk Existing control measure occurring (Catastrophic, Major,
(Extreme, High, Moderate,
(Almost certain, Likely, Moderate, Minor,
Low)
Possible, Unlikely, Rare) Insignificant)

February 2003 Page 9

RISK MANAGEMENT STEP 3 - ANALYSE THE RISK

Glossary
(All definitions from Australian/New Zealand Standard for Risk Management AS/NZS
4360:1999)

Frequency A measure of the rate of occurrence of an event expressed as the

number of occurrences of an event in a given time.

Monitor To check, supervise, observe critically, or record the progress of

an activity, action or system on a regular basis in order to identify
change.

Probability The likelihood of a specific event or outcome, measured by the

ratio of specific events or outcomes to the total number of
possible events or outcomes.

Risk control That part of risk management which involves the implementation
of policies, standards, procedures and physical changes to
eliminate or minimize adverse risks.

Risk treatment Selection and implementation of appropriate options for dealing

with risk.

February 2003 Page 10