How do you perform a basic risk assessment using likelihood and impact?

• A. Rate probability and impact on predefined scales, calculate risk rating, and prioritize mitigations accordingly.
• B. Rate probability but ignore impact.
• C. Use gut feeling for risk rating.
• D. Only track risks without rating.

Answer: (A)

Assessing risk relies on combining two things: how likely an event is to occur and how severe the consequences would be if it happens. By using predefined scales for both likelihood and impact, you assign a clear value to each dimension rather than guessing. Then you combine those values to produce a risk rating, often by multiplying the two numbers or by placing them on a risk matrix. That rating gives you a quantitative or semi-quantitative measure that you can use to rank risks and decide where to focus mitigations and resources.

This approach matters because an event that’s very likely but only mildly impactful might be less urgent than one that’s rare but with catastrophic consequences. Relying on gut feeling or tracking risks without a rating doesn’t yield a consistent way to compare different risks or to prioritize actions.