This is the second step, once the risk points have been identified.
The below is the typical matrix:
- High likelihood of occurrence – high impact: consider for immediate action
- Low likelihood of occurrence–high impact: Consider for action and have a contingency plan
- High likelihood of occurrence–low impact: Consider action
- Low likelihood of occurrence–low impact: Keep under periodic review
Not only do they result into a financial penalty, but there are other likely outcomes – highly important to be managed – legal risk, reputational risk, etc.