Categorizing Risks—Frequency and Consequence

Knowing the sources of risk in an organization is important. However, in order to focus efforts for maximum benefit, it is necessary to understand two key factors. Specifically: 1) how often will the risk manifest as an actual loss, and 2) what is the severity or consequence of that loss? Table 5.1 places the possible combinations into risk quadrants.

Most organizations initially focus on the upper right-hand quadrant, where small incremental reductions in risk exposure can have a large impact on the value of the organization.