ASSESS A RISK
Describe the risk, score it before controls, record what is already protecting you, then score what remains.
1 / DESCRIBE IT
Write the actual thing that could happen and what the consequence would be.
2 / SCORE IT
Rate likelihood and impact before controls, then again after controls.
3 / DO SOMETHING
Add mitigation, owner and review date. Mitigation can become a checklist action.
RISK ASSESSMENTLOCAL-ONLY
What could go wrong?
Before controls
Score the risk as if your existing controls were not helping.
What already reduces the risk?
What remains after controls?
What happens next?
SAVED RISKS