Quote=Ley45699]Does anyone have a template for a simple risk profile that they are willing to share. I have access to a version based on failure mode effect analysis but it is very complicated to use. Is there a way to merge risks identified during the proactive risk assessment process and those identified as a result of reactive incidents I wonder?

Got to admit, I didn't understand the original post either, but if any of you could explain it i'd be interested to know what it refers to

I understand the difference on a linguistic level between a "proactive risk assessment" and "those identified as a result of reactive incidents"? What is the difference at the user level; how would a risk assessment following on from an incident differ from one that was the result of a proactive process other them in a particular workplace you might use a different proforma? This original poster must have a reason why he wants to “merge” them.

But when you do the reactive risk assessment you would just update the original with the additional information ( unless there was no original, so just new). No merging just the risk assessment. Do you mean where you identify risk levels before controls ( or with existing controls), then record the risk level following control measures ( or additional control) which should have reduced the risk, all being recorded in one line? Perhaps you should clarify with and example of your issue. Chris

For what its worth my organisation takes a very straight forward approach to it's Risk Profile: - the top 12 significant risks identified/prioritised (based on existing knowledge, HSE interventions, reputational & quality issues) - the known associated costs (one off and on-going) involved with managing these effectively - a small description of what would happen if things went south and - an annual (or more frequent if needed) review of the effectiveness of the controls. Our is a high level document agreed with the Board & shared across all areas of the organisation

So the risk profile is the information captured on a risk register! I understand the original posting now. As for the original question-would not the nature of the risk profile depend on the nature of the business? A risk profile for a large retail business would be very different for a set of labs in a university