What Is Risk Assessment in a Business Case?

Risk assessment is the systematic process of identifying, analysing and evaluating risks that could affect an option’s objectives, costs, benefits or delivery. It helps decision-makers understand what could happen, how significant the consequences could be and whether the risks are acceptable.

In a business case, risk assessment supports the comparison of options and the recommendation for approval. It should consider the risks of proceeding with an investment as well as the risks of continuing business as usual or doing nothing.

How Does Risk Analysis Differ from Risk Assessment?

Risk analysis is part of the broader risk assessment process:

• Risk identification: What could happen, why could it happen and which objectives could be affected?

• Risk analysis: How likely is it, what would the consequences be and how effective are the existing controls?

• Risk evaluation: Is the level of risk acceptable, and which risks require treatment or further investigation?

Risk treatment follows the assessment and determines what action should be taken.

What Should a Business Case Risk Assessment Include?

Focus on the material risks that could influence the investment decision. These may relate to demand, financial returns, technology, suppliers, implementation, workforce capability, regulatory requirements or the achievement of benefits.

For each material risk, explain:

• Cause, event and consequence: What could cause the risk, what might happen and how would it affect the option?

• Likelihood and impact: How likely is the event, and how significant could its consequences be?

• Existing controls: What measures are already in place?

• Proposed treatment: What additional action is needed, and what will it cost?

• Risk owner: Who is accountable for managing the risk?

• Residual risk: What risk would remain after the proposed measures are implemented?

A low-likelihood event may still require close attention if its consequences would be severe.

How Detailed Should the Analysis Be?

The depth of analysis should reflect the investment’s scale, complexity and uncertainty.

A qualitative assessment, using clearly defined likelihood and consequence ratings, may be sufficient for some decisions. More significant or uncertain investments may require quantitative analysis of potential cost increases, delays or benefit shortfalls.

Ratings and estimates should be supported by evidence and judgement. Avoid presenting uncertain probabilities as precise facts.

Example: A New Production System

A new production system may depend on specialist equipment arriving on time. A supplier delay could postpone commissioning, increase installation costs and defer productivity benefits.

The business case should assess this risk, identify measures such as supplier checks and schedule contingency, assign an owner and explain the remaining exposure. It should also consider the alternative risk of retaining existing equipment, including breakdowns, rising maintenance costs and lost production.

How Does Risk Assessment Relate to Scenario and Sensitivity Analysis?

Scenario analysis tests how an option performs under a plausible combination of conditions, such as higher costs, delayed implementation and lower benefits.

Sensitivity analysis helps identify which assumptions most affect the result.

​​​​​​​These techniques support risk assessment, but do not replace the need to identify specific risks, assign owners and plan appropriate responses.

A strong business case makes clear which risks can be managed, what managing them will cost and which remaining risks decision-makers are being asked to accept.

Explore My Risk Analysis for AI-assisted support in developing a risk assessment, then validate the output against your evidence and organisational requirements.