Strategy and analysis

Risk Prioritisation

Identify and compare the most significant threats, vulnerabilities, and uncertainties. Useful for governance, strategy, cybersecurity, operational planning, and compliance. The criteria can be changed, added to and weighted.

Start

What the framework is

Risk prioritisation ranks risks by how likely they are and how much damage they would do, so attention and budget go to the few that matter. It's the step between a risk register and a response plan.

What the result looks like

EXAMPLE
Which risks need a mitigation plan first?
Top ranked
Key supplier fails
Likelihood 92% · 1st
Severity 63% · 1st
Recovery Difficulty 38% · 3rd
Strategic Impact 75% · 1st
Detectability 50% · 2nd
63%
Weighted win rate

Overall

Options Weighted win rate
01
Key supplier fails
Likelihood 1st · Severity 1st · Recovery Difficulty 3rd · Strategic Impact 1st · Detectability 2nd
63%
02
Data breach
Likelihood 2nd · Severity 2nd · Recovery Difficulty 1st · Strategic Impact 3rd · Detectability 1st
52%
03
Loss of key staff
Likelihood 3rd · Severity 3rd · Recovery Difficulty 2nd · Strategic Impact 2nd · Detectability 3rd
35%

Overall with the criteria

Rank
Options
 Likelihood
20%
 Severity
20%
 Recovery Difficulty
20%
 Strategic Impact
20%
 Detectability
20%
 Overall
Weighted win rate
01 Key supplier fails
92%
1st
63%
1st
38%
3rd
75%
1st
50%
2nd
63%
02 Data breach
42%
2nd
58%
2nd
71%
1st
33%
3rd
54%
1st
52%
03 Loss of key staff
17%
3rd
29%
3rd
42%
2nd
42%
2nd
46%
3rd
35%

By the options

01 · Key supplier fails 63% weighted win rate
–
Likelihood
92%
1st of 3 · 22 Wins · 2 Losses
–
Severity
63%
1st of 3 · 15 Wins · 9 Losses
–
Recovery Difficulty
38%
3rd of 3 · 9 Wins · 15 Losses
–
Strategic Impact
75%
1st of 3 · 18 Wins · 6 Losses
–
Detectability
50%
2nd of 3 · 12 Wins · 12 Losses
02 · Data breach 52% weighted win rate
–
Likelihood
42%
2nd of 3 · 10 Wins · 14 Losses
–
Severity
58%
2nd of 3 · 14 Wins · 10 Losses
–
Recovery Difficulty
71%
1st of 3 · 17 Wins · 7 Losses
–
Strategic Impact
33%
3rd of 3 · 8 Wins · 16 Losses
–
Detectability
54%
1st of 3 · 13 Wins · 11 Losses
03 · Loss of key staff 35% weighted win rate
–
Likelihood
17%
3rd of 3 · 4 Wins · 20 Losses
–
Severity
29%
3rd of 3 · 7 Wins · 17 Losses
–
Recovery Difficulty
42%
2nd of 3 · 10 Wins · 14 Losses
–
Strategic Impact
42%
2nd of 3 · 10 Wins · 14 Losses
–
Detectability
46%
3rd of 3 · 11 Wins · 13 Losses
Scoring Explanations
CRITERIA WEIGHTINGS — The % weighting for each criterion is shown in the table header. Unless this was entered in the setup, the weighting is equal across criteria.
WEIGHTED WIN RATE — Each criterion's result, in the measure they share, averaged using the assigned weightings.

When it earns its place

Use it at a project kick-off, in an annual risk review, before an audit, or when a grant or tender asks for a risk assessment. The usual failure is scoring every risk "medium" on a 1-to-5 scale, while the register keeps growing and nobody chooses. Comparing risks head to head forces the choice.

How to run it with a group

  1. List six to ten risks, each specific. "Our main supplier fails" beats "supply chain".
  2. Participants compare the risks two at a time on likelihood, severity, recovery difficulty, strategic impact and detectability. Participants do not need an account to respond.
  3. Invite people who see risk from different places: finance, operations, frontline staff.
  4. For each of the top risks, name an owner and a response: avoid it, reduce it, transfer it or accept it.

Get started

Start