Environmental, Social and Governance (ESG) - Principles and Practice · Risk Management

Risk Identification, Assessment and Measurement Techniques

Updated 11 October 2026 · Fact-checked

Risk identification finds what could go wrong. Risk assessment rates each risk by likelihood and impact. Measurement puts a score or value on it. You record results in a risk register, plot them on a heat map, and rank them so the board knows which risks need action first.

Understand Risk Identification, Assessment and Measurement

A risk is the effect of uncertainty on objectives. It can be a threat or an opportunity. Before you can manage a risk, you must first know it exists, how likely it is and how much damage it can do. That is why risk work follows an order: identify, assess, measure, prioritise.

Risk identification builds the list of risks. Common techniques are brainstorming workshops, interviews, questionnaires and surveys, checklists, SWOT and PESTLE analysis, process mapping, review of past incidents and audit findings, scenario analysis and horizon scanning. Use more than one technique. Each one misses something the others catch.

Risk assessment judges each identified risk. You look at likelihood (how probable) and impact (how severe). You also consider inherent risk (before controls) and residual risk (after controls). In ESG, impact covers financial loss, legal penalty, reputation harm and harm to people and the environment.

Qualitative assessment uses descriptive scales such as low, medium, high, based on judgement. It is quick and works where data is thin. Quantitative assessment uses numbers, such as expected loss in rupees, probability percentages, sensitivity analysis, scenario analysis, Value at Risk and simulation. It is more precise but needs reliable data. Many companies use a semi-quantitative scale, scoring 1 to 5 for each axis.

The risk register is the record of every risk with its owner, score, controls and actions. The heat map is a grid of likelihood against impact, coloured green, amber and red, so the board sees priorities at a glance. Risks are then ranked against the company's risk appetite (how much risk it is willing to take) and risk tolerance.

Key rules to remember

Risk score (semi-quantitative): Risk score = Likelihood score × Impact score; On a 5 × 5 scale the score ranges from 1 to 25. Cut-offs for low, medium and high are set by the company, not fixed by law.
Expected loss: Expected loss = Probability of event × Loss if it occurs; Use for quantitative ranking. A 10% chance of a ₹50,00,000 loss gives ₹5,00,000.
Residual risk: Residual risk = Inherent risk − Effect of controls; Conceptual relation, not an exact arithmetic subtraction. It shows risk left after controls work.
Risk register fields: ID, description, category, cause, likelihood, impact, score, owner, controls, action, status; A good register has an owner and a review date for every risk.

How to solve Risk Identification, Assessment and Measurement questions

Use this order for any question on identifying, assessing or measuring risk, whether it asks for a list, a comparison or a case analysis.

1Define the term the question uses in one line, such as risk, inherent risk or risk register.
2Identify the risks from the facts given. Group them by category: strategic, operational, financial, compliance, environmental, social, governance.
3Name the technique you would use to find them, and say why it suits this case.
4Assess each risk for likelihood and impact, using a stated scale. Mention inherent and residual levels if controls are given.
5Choose qualitative, quantitative or semi-quantitative measurement and justify it by data availability.
6Score, rank and place the risks on a heat map or in a register. Link the ranking to risk appetite.
7Conclude with the top priority risks, owners and the next step, which is treatment and monitoring.

Quickest way: Five-line risk answer

When to use it: Use when time is short and the question asks you to assess risks in a short case.

List three to five risks from the facts, each in one line with its category.
Give each a likelihood and impact score from 1 to 5.
Multiply to get the score and rank them.
State the colour band: red for high, amber for medium, green for low.
End with owner and one action for the top risk.

Common mistakes in Risk Identification, Assessment and Measurement

Confusing risk identification with risk assessment.
Both words sound alike and happen in one workshop.
Fix: Identification asks what can go wrong. Assessment asks how likely and how bad. Answer each separately.
Saying quantitative is always better than qualitative.
Numbers feel more reliable.
Fix: Say it depends on data. Qualitative suits new or intangible risks such as reputation. Quantitative suits risks with good data.
Plotting a heat map with only impact.
Students focus on the size of the loss.
Fix: Always use two axes: likelihood and impact. Show the score as their product.
Ignoring controls and showing only inherent risk.
The case gives no explicit instruction to consider controls.
Fix: Mention residual risk whenever controls exist, and say which one the heat map shows.
Leaving out owner and review date in a risk register.
Students treat the register as a simple list.
Fix: Add owner, controls, action and status for every risk. Without an owner, nobody acts.
Treating ESG risks as outside the risk process.
ESG is seen as a reporting topic.
Fix: Show climate, human rights and governance risks in the same register with the same scoring.

Worked examples

Example 1

Greenfield Textiles Ltd, a Tiruppur manufacturer, faces three risks: (a) a water shortage that may halt dyeing operations, probability 20%, loss ₹40,00,000; (b) a data breach, probability 5%, loss ₹1,00,00,000; (c) a supplier labour-rights controversy, probability 10%, loss ₹30,00,000. Rank them by expected loss and name the method used.

Show the solution

The method is quantitative, because probabilities and rupee losses are given.
Expected loss = probability × loss.
Water shortage: 0.20 × ₹40,00,000 = ₹8,00,000.
Data breach: 0.05 × ₹1,00,00,000 = ₹5,00,000.
Supplier controversy: 0.10 × ₹30,00,000 = ₹3,00,000.
Rank from highest to lowest: water shortage, data breach, supplier controversy.

Answer: Water shortage (₹8,00,000) ranks first, data breach (₹5,00,000) second, supplier controversy (₹3,00,000) third. The board should add that the data breach has a low probability but a high impact, so expected loss alone should not decide its treatment.

Example 2

Using a 5 × 5 scale, a company scores a factory emissions breach at likelihood 4 and impact 5, and a minor office waste issue at likelihood 3 and impact 1. Assume 15 to 25 is red, 8 to 14 amber and 1 to 7 green. Place both on the heat map and state what the board should do.

Show the solution

Score = likelihood × impact.
Emissions breach: 4 × 5 = 20.
Office waste: 3 × 1 = 3.
Emissions score 20 falls in 15 to 25, so it is red.
Waste score 3 falls in 1 to 7, so it is green.
Red needs immediate treatment with a named owner. Green is accepted and monitored.

Answer: The emissions breach scores 20 and sits in the red zone, so it needs urgent treatment and board attention. The waste issue scores 3 and sits in the green zone, so it is monitored. The cut-offs are the company's own, set by its risk appetite.

Exam tips

Write the definition first, then the technique, then the application. Case answers earn marks for all three.
Draw a small 3 × 3 or 5 × 5 grid for the heat map when a question asks for it. A neat sketch scores well.
When asked to compare qualitative and quantitative methods, give at least four points: basis, data need, precision, cost and typical use.
Use ESG examples such as climate, water, labour and data privacy to show you link this topic to the paper.
State that scoring bands and risk appetite are company-set, so you do not present them as legal rules.

Practice questions from Risk Management

Risk Identification, Assessment and Measurement in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Risk Identification, Assessment and Measurement: frequently asked questions

What is the difference between qualitative and quantitative risk assessment?

Qualitative assessment rates risks with descriptive scales such as low, medium and high, based on judgement. Quantitative assessment uses numbers such as probabilities and rupee losses. Qualitative is faster and needs little data. Quantitative is more precise but needs reliable data.

What goes into a risk register?

A risk register lists each risk with an ID, description, category, cause, likelihood, impact, score, owner, existing controls, planned actions and status. It is reviewed regularly. The owner field is essential, because it fixes responsibility.

What is a heat map in risk management?

A heat map is a grid with likelihood on one axis and impact on the other. Risks are plotted in cells coloured green, amber or red. It shows the board which risks need action first.

What are the main risk identification techniques?

Common techniques are brainstorming, interviews, questionnaires, checklists, SWOT and PESTLE analysis, process mapping, scenario analysis and review of past incidents. Use several together, because each one has blind spots.