Risk assessment, ranked.
Also called: Risk register · Risk matrix · Likelihood-impact ranking · Project risk review
Listing the project’s real risks, ranking each by likelihood times impact, and attaching one concrete mitigation to every risk that matters.
Name the risks that could sink the product, score each by likelihood times impact, and give the top few a named mitigation. Three sharp risks beat thirty vague ones. This is the commercial cut, not the engineering FMEA. There’s a worked table below.
What a risk assessment is
A risk assessment is the deliberate act of asking, before you commit money, what could stop this product working commercially, and how likely each thing is. You list the risks, score each on two axes, likelihood and impact, and let the multiplication sort them. A risk that is both probable and fatal goes to the top. A risk that is rare and survivable goes to the bottom, or off the list entirely.
The ranking is the whole point. A flat list of forty worries tells you nothing about where to spend your attention. Likelihood times impact forces a decision: this one first, that one later, those three I will accept and move on. You are not trying to eliminate risk, which is impossible. You are trying to know which risks deserve a mitigation and which you can knowingly carry.
This is the idea-stage commercial and strategic cut. It deals in margins, supply chains and shipping, not in tolerances and failure modes. The detailed engineering version, where you decompose a part and ask how each feature could fail in service, is the FMEA at Stage 07 Engineer. Different tool, different stage. Doing the heavy FMEA now, on a product you might still kill, is wasted effort. Skipping the commercial cut now is how you find the killer risk after you have spent the tooling budget.
The worked risk table
The clearest way to do this is to rank the few risks that genuinely threaten the product, then attach a mitigation to each. Here is the proofing box’s, the one we ran in the pilot, so you can see the shape of a good answer rather than a generic template.
Three risks, each scored, each owned, each with one concrete action. Notice the mitigations are testable jobs, not intentions. “Be careful with the BOM” is not a mitigation. “Freeze a £55 ceiling and re-cost at every change” is.
- Forty risks, none ranked, all equal.
- Scores assigned, then never used to decide anything.
- “Monitor closely” written next to every line.
- No owner, so nobody acts.
- The three that could actually kill it, ranked.
- Each scored by likelihood times impact.
- One concrete, testable mitigation per risk.
- A named owner, so the action happens.
How it fits the bigger picture
Risk assessment is activity 04.10.03 in the framework, sitting inside Stage 04 Evaluate. It feeds straight into check bias (04.10.04), where you stress-test whether you have under-rated the risks you would rather not see. The detailed engineering version of this thinking, the FMEA, comes much later, at Stage 07 Engineer, once you are committed and decomposing real parts.
What it can do
It tells you where to spend your worry, and your money. A ranked list with mitigations turns a vague unease about “all the things that could go wrong” into three jobs with owners. It also gives you permission to consciously accept the small stuff and stop fretting over it.
What it can’t do
It can’t find the risk you can’t see; that is the job of check bias and outside review. And it isn’t the engineering FMEA. It works in commercial probabilities, not in part-level failure modes, so it will not catch a thermal-fuse fault or a creep-fatigue crack. Those wait for Stage 07.
See the full 10-stage process →
Try it yourself
Write down every way this product could fail commercially: margin, demand, supply, shipping, regulation. Score each one, likelihood one to five, impact one to five, and multiply. Sort by the score. Take the top three and give each a single concrete mitigation with a name against it. Accept the rest, knowingly, and stop worrying about them.
Want a guided first pass? Start the Free Sprint → and the GPT will help you surface the risks worth ranking.
Your risk checklist
Project notes: the three that mattered
▸ From the notebook · optional reading
Project notes: three risks, one rig
Dan and Anna Hartley in Stockport had a list of fifteen worries. We ranked them, and three carried almost all the weight.
3 min read · click to open
Dan arrived with a list of fifteen risks, all written in the same anxious font size. I asked him to score each one, likelihood times impact, and watched the list collapse. Twelve of them were either improbable or survivable. Three were not.
The three that survived the scoring
R1, the BOM against the margin. The whole £149 case rested on a £38–55 bill of materials. Every “while we’re at it” addition, a nicer encoder, a thicker wood cladding, nudged it upward. We froze a £55 ceiling and made a breach trigger a review, not a shrug. This was the risk most likely to be killed by a thousand small, reasonable decisions.
R2, holding the temperature. A Stockport kitchen in February swings between 14°C and 19°C, and the product’s one promise was 26°C give or take half a degree. If the control loop couldn’t manage that, nothing else mattered. We pushed this to the front and built a heated-mass test rig before committing to any ceramic tooling. It was the riskiest assumption, so it got tested first.
R3, the ceramic arriving in pieces. A beautiful Stoke-on-Trent shell is worth nothing smashed in a courier van. We drop-tested the packaged unit and designed the inserts to a shock spec rather than to taste. Quiet risk, but a 5% breakage rate would have eaten the margin we fought to protect in R1.
The other twelve we wrote down, accepted, and stopped discussing. That was the real value. Not a longer list, a shorter one, with the survivors actually owned. (Two of the accepted risks did surface later; both were survivable, exactly as scored, and neither was a surprise.)
— Evaluate stage, project notes, 2026
— Next in Evaluate → Check bias