In the risk prioritization step, the overall set of identified risk events, their impact assessments, and their probabilities of occurrences are \"processed\" to derive a most-to-least-critical rank- order of identified risks. A major purpose of prioritizing risks is to form a basis for allocating resources. Multiple qualitative and quantitative techniques have been developed for risk impact assessment and prioritization. Qualitative techniques include analysis of probability and impact, developing a probability and impact matrix, risk categorization, risk frequency ranking (risks with multiple impacts), and risk urgency assessment. Quantitative techniques include weighting of cardinal risk assessments of consequence, probability, and timeframe; probability distributions; sensitivity analysis; expected monetary value analysis; and modeling and simulation. A Risk Analysis may identify a number of risks that appear to be of similar ranking or severity. When too many risks are clustered at or about the same level, a method is needed to prioritize risk responses and where to apply limited resources. Such a method should be tied to mission/business needs and maximize the use of available resources. A rational and common sense prioritization is a key component of a risk management program and becomes necessary when requirements cannot be fully satisfied. In the event the identified risk (or set of risks) materialized: ->How critical would the immediate impact be to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation? ->How critical would the future impact be to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation? The answers to the above questions provide the basis for a justifiable prioritization that is based on current and future organizational needs. Mission/business owners (or their designees) and mission/business subject matter experts can be consulted to obtain the most complete and up-to- date information. The challenge in it is the first activity within the risk assessment process which is to develop a common set of assessment criteria to be deployed across business units, corporate functions, and large capital projects. Risks and opportunities are typically assessed in terms of impact and likelihood. Many enterprises recognize the utility of evaluating risk along additional dimensions such as vulnerability and speed of onset. Assessing risks consists of assigning values to each risk and opportunity using the defined criteria. This may be accomplished in two stages where an initial screening of the risks is performed using qualitative techniques followed by a more quantitative analysis of the most important risks. Risks do not exist in isolation. Enterprises have come to recognize the importance of managing risk interactions. Even seemingly insi.

1. In the risk prioritization step, the overall set of identified risk events, their impact assessments,
and their probabilities of occurrences are "processed" to derive a most-to-least-critical rank-
order of identified risks. A major purpose of prioritizing risks is to form a basis for allocating
resources.
Multiple qualitative and quantitative techniques have been developed for risk impact assessment
and prioritization. Qualitative techniques include analysis of probability and impact, developing
a probability and impact matrix, risk categorization, risk frequency ranking (risks with multiple
impacts), and risk urgency assessment. Quantitative techniques include weighting of cardinal
risk assessments of consequence, probability, and timeframe; probability distributions;
sensitivity analysis; expected monetary value analysis; and modeling and simulation.
A Risk Analysis may identify a number of risks that appear to be of similar ranking or severity.
When too many risks are clustered at or about the same level, a method is needed to prioritize
risk responses and where to apply limited resources. Such a method should be tied to
mission/business needs and maximize the use of available resources. A rational and common
sense prioritization is a key component of a risk management program and becomes necessary
when requirements cannot be fully satisfied.
In the event the identified risk (or set of risks) materialized:
->How critical would the immediate impact be to organizational operations (including mission,
functions, image, or reputation), organizational assets, individuals, other organizations, or the
Nation?
->How critical would the future impact be to organizational operations (including mission,
functions, image, or reputation), organizational assets, individuals, other organizations, or the
Nation?
The answers to the above questions provide the basis for a justifiable prioritization that is based
on current and future organizational needs. Mission/business owners (or their designees) and
mission/business subject matter experts can be consulted to obtain the most complete and up-to-
date information.
The challenge in it is the first activity within the risk assessment process which is to develop a
common set of assessment criteria to be deployed across business units, corporate functions, and
large capital projects. Risks and opportunities are typically assessed in terms of impact and
likelihood. Many enterprises recognize the utility of evaluating risk along additional dimensions
such as vulnerability and speed of onset.
Assessing risks consists of assigning values to each risk and opportunity using the defined
criteria. This may be accomplished in two stages where an initial screening of the risks is
performed using qualitative techniques followed by a more quantitative analysis of the most

2. important risks.
Risks do not exist in isolation. Enterprises have come to recognize the importance of managing
risk interactions. Even seemingly insignificant risks on their own have the potential, as they
interact with other events and conditions, to cause great damage or create significant opportunity.
Therefore, enterprises are gravitating toward an integrated or holistic view of risks using
techniques such as risk interaction matrices, bow-tie diagrams, and aggregated probability
distributions.
Solution
In the risk prioritization step, the overall set of identified risk events, their impact assessments,
and their probabilities of occurrences are "processed" to derive a most-to-least-critical rank-
order of identified risks. A major purpose of prioritizing risks is to form a basis for allocating
resources.
Multiple qualitative and quantitative techniques have been developed for risk impact assessment
and prioritization. Qualitative techniques include analysis of probability and impact, developing
a probability and impact matrix, risk categorization, risk frequency ranking (risks with multiple
impacts), and risk urgency assessment. Quantitative techniques include weighting of cardinal
risk assessments of consequence, probability, and timeframe; probability distributions;
sensitivity analysis; expected monetary value analysis; and modeling and simulation.
A Risk Analysis may identify a number of risks that appear to be of similar ranking or severity.
When too many risks are clustered at or about the same level, a method is needed to prioritize
risk responses and where to apply limited resources. Such a method should be tied to
mission/business needs and maximize the use of available resources. A rational and common
sense prioritization is a key component of a risk management program and becomes necessary
when requirements cannot be fully satisfied.
In the event the identified risk (or set of risks) materialized:
->How critical would the immediate impact be to organizational operations (including mission,
functions, image, or reputation), organizational assets, individuals, other organizations, or the
Nation?
->How critical would the future impact be to organizational operations (including mission,
functions, image, or reputation), organizational assets, individuals, other organizations, or the
Nation?
The answers to the above questions provide the basis for a justifiable prioritization that is based
on current and future organizational needs. Mission/business owners (or their designees) and
mission/business subject matter experts can be consulted to obtain the most complete and up-to-

3. date information.
The challenge in it is the first activity within the risk assessment process which is to develop a
common set of assessment criteria to be deployed across business units, corporate functions, and
large capital projects. Risks and opportunities are typically assessed in terms of impact and
likelihood. Many enterprises recognize the utility of evaluating risk along additional dimensions
such as vulnerability and speed of onset.
Assessing risks consists of assigning values to each risk and opportunity using the defined
criteria. This may be accomplished in two stages where an initial screening of the risks is
performed using qualitative techniques followed by a more quantitative analysis of the most
important risks.
Risks do not exist in isolation. Enterprises have come to recognize the importance of managing
risk interactions. Even seemingly insignificant risks on their own have the potential, as they
interact with other events and conditions, to cause great damage or create significant opportunity.
Therefore, enterprises are gravitating toward an integrated or holistic view of risks using
techniques such as risk interaction matrices, bow-tie diagrams, and aggregated probability
distributions.