“Risk Assessment” describes a proactive, methodical process for establishing the context, identifying, analyzing, evaluating, managing, monitoring and communicating risk. Risk management involves the systematic use of available information to determine how often specified events may occur and the magnitude of the consequences. Management should be provided with relevant, timely information to allow them to optimize decisions among competing alternatives to achieve business goals.

Risk assessments seek to measure uncertainty: identifying chance of something happening that will have an impact on objectives – in either a positive or negative way. The key is to seek the upside of opportunities while managing the downside of threats and hazards. Given the constantly changing business environment, the risk assessment process must be constantly and actively seeking to identify these opportunities, threats, and hazards.

The effect of a risk occurrence is typically measured in terms of consequences (impacts) if the risk were to occur, and likelihood of the risk occurrence. In the evaluations of risks in a business process, the impact is measured in terms of the effects to the achievement of organizational objectives. Often, the impact and likelihood factors are rated and graphed in a 2-axis chart to help visually identify the most critical items for remediation: those risks with both a high impact if they were to occur, and a high likelihood of occurrence.

The risk assessment process is a crucial factor in an organization's future success. Risk management practices should provide an accurate lens on how well the organization is prepared for uncertainties in the future, including providing advance direction to employees for actions to be taken should the risk occur.

Risk assessment is a key component to many organizational initiatives, including:

> Fraud Deterrence – Risk assessments are used to evaluate the potential effects of non-performance of a control procedure, including the ability to safeguard assets and ensure accurate reporting of transactions. Also used in the evaluation of the need for enhanced or improved controls (i.e. balancing risk against cost of control)

> Internal Audit – Risk assessments are used to rank and prioritize audit universe items and develop audit plans and timelines

> Business Continuity Planning – Risk assessments are used to evaluate events which could cause a disruption to processing objectives (impact) and a likelihood of risk occurrence sufficiently high to require the development of contingency plans