A low-probability risk could be catastrophic. How do we assess it?
Severe low-frequency exposureDo not let a simple average score conceal unacceptable consequences. Obtain specialist input, examine credible scenarios, and apply the organization's safety, security, and risk-acceptance rules.
What to do now
- Describe the severe credible scenario
- Consult the relevant specialists
- Assess prevention and response controls
- Escalate acceptance to the proper authority
When to escalate
Escalate when
The consequence involves serious harm or exceeds delegated tolerance.
Who decides
The accountable risk owner
Example
A rare data-loss scenario receives recovery testing even though routine incidents are more frequent.
Mistake to avoid
Dismissing severe exposure because it has not happened before.
Prevent a repeat
Review whether response tasks and trigger conditions remain appropriate as the project changes.
Suggested ApprovedFlow setup
- Documents
- Tasks
- Approvals
Store the risk assessment as a controlled project document and assign response tasks; do not assume a native risk engine is enabled. See the platform
Related cases
- How often should we review project risks?Static risk review cadence
- How should we handle a risk we cannot prevent?Unavoidable exposure
- How do we assess the impact of a change properly?Incomplete change analysis
- We discovered a dependency late in the project. How do we assess it?Hidden dependency