Risk analysis: methods, types and a worked example

Risk analysis is where a list of worries becomes a ranked set of risks you can act on. This guide goes deep on the analysis step itself: what you actually analyse, the difference between qualitative, semi-quantitative and quantitative risk analysis, the main methods — risk matrix, bow-tie, FMEA, expected loss and Monte Carlo — how to pick one, and a worked example that analyses the same risk three ways.

By Alex Martyushin, founder & risk consultant · Updated 30 October 2026 · 14 min read

Where risk analysis sits in the process

In ISO 31000, risk assessment has three steps: identification (what could happen), analysis (how big is it) and evaluation (does it need treatment, and in what order). Analysis is the middle step and the one that most often goes wrong — either reduced to a gut-feel number or inflated into a model nobody trusts.

This guide focuses on analysis only. For the whole cycle — context, identification, treatment, monitoring — read what is risk management; for the standard itself, ISO 31000 in plain English.

What a good risk analysis covers

Likelihood × impact is the headline, but a useful analysis records more than two numbers:

• Causes and sources. What would make the event happen? Several causes often lead to the same event.
• Consequences. Financial, operational, legal, reputational, people and safety — and whether one event can trigger others.
• Likelihood. As a probability over a period, a frequency, or a descriptive rating.
• Existing controls and their effectiveness. The difference between inherent and residual risk depends on this, so test controls rather than assume them.
• Velocity. How quickly the impact arrives; a fast-onset risk leaves no time to react.
• Uncertainty and confidence. How good is the information behind the estimate? A rating based on five years of incident data is not the same as a guess.
• Assumptions. Write them down. They are what the next reviewer needs to challenge.

Qualitative vs semi-quantitative vs quantitative risk analysis

Most registers are in fact semi-quantitative: the 1–5 scales of a 5×5 risk matrix become far more consistent once each level has a defined range. “Likely” means different things to different people; “at least once a year” does not.

Risk analysis methods

IEC 31010:2019, the companion standard to ISO 31000, describes dozens of risk assessment techniques. A handful cover almost every need of a small or mid-sized organisation.

Risk matrix

Rate likelihood and impact on defined scales, multiply or look up the cell, and colour-code. It is the backbone of most registers because it is quick and everyone understands it. Its limits are real: it cannot add risks together, it squashes very different risks into the same cell, and it handles low-likelihood, high-impact risks poorly unless you treat them separately. Our risk matrix guide covers scales and design in detail.

Bow-tie analysis

A bow-tie puts the risk event in the centre — the “knot” — with threats (causes) on the left and consequences on the right. Between threats and the event sit preventive controls; between the event and consequences sit recovery controls. Escalation factors show what could make a control fail.

Bow-ties shine in workshops because they make control gaps visible: a threat with no preventive barrier, or a consequence with no recovery plan, jumps off the page. They are qualitative, but they make the subsequent likelihood and impact rating much better informed. Use them for your top five to ten risks, not for every line in the register.

Failure mode and effects analysis (FMEA)

FMEA breaks a process or product into steps, asks how each step can fail (the failure mode), what the effect would be and what causes it. Each failure mode is traditionally rated 1–10 for severity (S), occurrence (O) and detection (D), and multiplied into a risk priority number: RPN = S × O × D, ranging from 1 to 1,000.

RPN has a known weakness: very different combinations give the same number, and a severe failure with low occurrence can rank below a trivial frequent one. The AIAG–VDA FMEA handbook published in 2019 replaced RPN with an “action priority” table that gives more weight to severity. Whichever version you use, the value of FMEA is the systematic walk through every step — it finds failure points a brainstorm misses.

Fault tree and event tree analysis

A fault tree starts with an undesired top event (“customer orders not dispatched”) and works backwards through AND/OR gates to basic causes. With probabilities attached, it calculates how likely the top event is and which combinations of failures matter most. An event tree goes the other way: from an initiating event, it follows each control succeeding or failing to the range of outcomes. Both come from safety engineering and are worth learning if you run critical operations; for most office-based businesses a bow-tie captures the same thinking with less effort.

Expected loss and annualised loss expectancy

The simplest quantitative method multiplies how often a loss happens by how much it costs. In information security this is often written as ALE = SLE × ARO: annualised loss expectancy equals single loss expectancy times annual rate of occurrence.

Example: a company estimates that a lost or stolen laptop costs about £2,500 once replacement, staff time and incident handling are counted (SLE), and expects such a loss about once every two and a half years (ARO = 0.4). ALE = £2,500 × 0.4 = £1,000 a year. If full-disk encryption and a device management tool cost far less than that and also cut the data-breach consequence, the decision is easy.

The weakness is that a single point estimate hides the spread. “£1,000 a year” is an average of many years with no loss and the occasional bad one.

Monte Carlo simulation

Monte Carlo simulation replaces single numbers with ranges, then samples from them thousands of times to produce a distribution of possible outcomes. Instead of “£12,000 a year” you get “a median year costs about £10,000, but one year in ten costs more than £29,000”. That is the information you need for decisions about insurance limits, contingency budgets and risk appetite.

It needs three things: a model of how the loss arises (frequency × severity is enough for most operational risks), a range for each input — commonly a minimum, most likely and maximum — and a tool. A spreadsheet can do it; so can a few lines of code. Frameworks such as FAIR (Factor Analysis of Information Risk) apply the same idea specifically to cyber and information risk.

How to choose a risk analysis method

A good rule: analyse every risk on the matrix, use a bow-tie for the top handful, and go quantitative only where a decision with a real price tag depends on it.

Worked example: one risk analysed three ways

A UK online retailer with about 30 staff relies on a single hosted ecommerce platform. The risk: “Because we depend on one hosted ecommerce platform with no fallback checkout, a platform outage stops online sales, causing lost revenue and customer complaints.”

1. Qualitative

In a workshop, the team agrees outages are “possible” and the impact “major” during trading hours. On a 5×5 matrix that is likelihood 3, impact 4, a score of 12 — high. Useful for ranking, but it does not say whether a £3,000-a-year fallback checkout is worth buying.

2. Semi-quantitative

The company’s scales define likelihood 3 as “once every one to three years or more often” and impact 4 as “£10,000–£50,000 or a week of disruption”. The team checks the platform’s status history and their own records: there were two noticeable outages in the last two years, lasting between two and eight hours. The rating stays at 3 × 4, but now it is anchored to evidence and the assumptions are recorded.

3. Quantitative

To decide on the fallback, the team estimates three inputs as ranges (minimum / most likely / maximum):

A point estimate with the most likely values gives 1 × 6 × £700 = £4,200 a year. But the ranges are skewed — outages can be long, and some years have several — so the average is higher. Using the mean of each range (1.5 outages, about 10.7 hours, about £767 an hour) the expected loss is about £12,300 a year: almost three times the point estimate.

A Monte Carlo simulation of 100,000 years, with outages per year drawn from the frequency range and each outage’s duration and cost drawn from their ranges, gives:

The fallback — a second payment and checkout route the team can switch to — is assumed to cut lost hours per outage to between 1 and 6, most likely 2. At £3,000 a year it reduces expected loss by about £8,800 and cuts the bad-year loss by about £20,000. The decision is clear in money terms, which the qualitative score alone could not show. The inputs are illustrative; the method is what matters.

Making the analysis honest

• Define your scales. Put numbers behind every level, and use the same scales across the organisation.
• Separate estimate from preference. The person who owns the budget for a control has an interest in the rating; ask several people independently, then discuss.
• Watch for anchoring. Ask for the range before anyone says a number out loud.
• Use reference data. Your own incident log, supplier status pages, insurance claims data and sector reports beat intuition.
• Record confidence. A simple high / medium / low next to each rating tells evaluators which numbers to challenge.
• Analyse controls as they work, not as designed. A backup that has never been restored is not a control yet.
• Revisit after incidents. Every real event is free calibration data.

Recording risk analysis in the register

Whatever method you use, the register should capture the result and its basis so that someone else can review it next quarter:

Common mistakes

• Undefined scales. If “4” means different things to different assessors, the register is a collection of opinions.
• Adding or averaging matrix scores. Ordinal ranks do not add up; only money and probabilities do.
• One number for a skewed risk. Use ranges for anything with a long tail.
• Ignoring control failure. Residual ratings that assume perfect controls are wishful thinking.
• False precision. Quoting a cyber loss to the nearest pound on the back of guesses undermines trust. Round, and show ranges.
• Analysing once. Likelihood and impact move with your business, your suppliers and the threat landscape.