Find the final risk ratings

Using the list of existing controls, see how they do or do not affect the initial risk ratings. You’ll get the final risk ratings — also called residual or net ratings.

Effects of the existing controls

Take into account the controls currently in place. The business owner and stakeholders need to assess if the existing controls reduce either, or both, a risk’s:

Find the final risk ratings

Use the risk matrix you used to find the initial risk ratings. This time, use the matrix with any updated risk impact and likelihood ratings.

For each risk, by mapping the adjusted, or sometimes unchanged, impact and likelihood ratings on the matrix, you’ll get the final risk ratings — sometimes called residual or net ratings.

Find the initial risk rating: Example of a risk matrix

Examples of final risk ratings

Example — Risk scenario, initial risk rating: zone 3

An existing control is highly effective at reducing the impact of the risk happening, which means:

  • the risk’s impact rating is revised to ‘moderate’
  • using the risk matrix, this gives the risk a final risk rating in zone 2.

Example — Risk scenario, initial risk rating: zone 3

An existing control is highly effective at reducing the likelihood of the risk happening, which means:

  • the risk’s likelihood rating is revised to ‘possible’
  • using the risk matrix, this gives the risk a final risk rating in zone 2.

Example — Risk scenario, initial risk rating: zone 4

An existing control is effective at reducing the impact of the risk happening, which means:

  • the risk’s impact rating is revised to ‘significant’
  • using the risk matrix, this gives the risk a final risk rating in zone 3.

Next steps — prioritise, evaluate and use

To finish your risk assessment:

Utility links and page information

Was this page helpful?
Thanks, do you want to tell us more?

Do not enter personal information. All fields are optional.

Last updated