Now, on a scale of 1–5, where 5 is high, decide how likely each risk is to happen (likelihood). Then decide, again on a scale of 1–5, how much of an impact it would have on the project if it happened (impact).

Again, discussion is very helpful. Agree first what each value means, where, for example, on impact, ‘5’ means that the project could not continue, ‘4’ means that it would have a significant effect on the bottom line, and so on. As you get further down the list of risks, you might want to revisit those you did earlier to make sure your analysis is consistent.

Now multiply ‘likelihood’ by ‘impact’ to give you an overall rating for each risk, from 0 to 25. This will show you where to concentrate your effort. You can use a traffic light system for this, where Red is anything over about 18, Amber is 10–18 and Green is anything under 10. And if you feel that any of them don’t come high enough up, then revisit your analysis. You must be comfortable with this. Any risk which rates Red or Amber should be mitigated in some way.

Example: