See the risk before it becomes the incident

Establish the full set of risks relevant to the client — not only the ones that prompted the enquiry. Identification draws on observation, interviews with people at different levels, examination of processes and routines, and structured consideration of categories that are commonly overlooked.

The most frequent failure at this stage is narrowness: assessing the risk the client named while leaving the adjacent one unexamined. The second most frequent is the opposite — an unusable list of everything conceivable.

Evaluate each identified risk for likelihood and for consequence, using consistent qualitative bands and recording the reasoning behind each judgement. Assessment considers existing controls: the question is the residual risk that remains after what the client already does.

Recording the reasoning matters more than the rating itself. A rating without reasoning cannot be challenged, updated or handed over.

Rank risks so that attention and expenditure go where they have most effect. Prioritisation is where a client's own tolerances become explicit: what they are prepared to accept, what they are not, and what they are obliged by regulation or duty of care to address regardless.

This stage frequently reduces the amount of work rather than increasing it. Several identified risks are usually best accepted, knowingly and on the record.

Select proportionate measures — procedural, physical, personnel or planning — and assign each an owner and a date. Mitigation includes the decision to accept a risk, which is a legitimate outcome when it is deliberate, documented and taken by someone with authority to take it.

Procedural measures usually precede expenditure. A change in who holds a schedule frequently reduces exposure more than equipment does.

Keep the assessment current. Monitoring means defined review intervals, named responsibility, and agreed triggers — a change of premises, a new market, a public appointment, an incident, a change in a principal's circumstances — that cause the assessment to be revisited before its scheduled date.

An assessment describes a moment. Unreviewed, it does not merely become outdated; it becomes misleading, because people continue to rely on it.

Feed experience back into the framework. Near-misses, minor incidents, rehearsal findings and even routine observations reveal where an assessment was wrong, and are the most valuable information available — provided the culture allows them to be reported without penalty.

Organisations that punish the reporting of near-misses stop hearing about them. They do not stop having them.