Risk Management Cycle Phases

Identify: Identify that a risk exits and give it a meaningful name.

Analyze: Determine the severity of the risk according to the risk matrix. If the risk is negligible (low to medium severity, low likelihood of occurrence), stop here. However, if the risk could cause damage to the system or the system's users, continue.

Plan: Decide how to combat the risk based on the risk's severity and likelihood of occurrence.

Mitigate: Follow the plan formulated in the previous phase as closely as possible to combat the risk. If this approach does not work, return to the previous phase and make a new plan. If the plan does work, continue analyzing the risk to determine whether it has been reduced to an acceptable severity level.

Track: Once the risk has been mitigated to an acceptable severity level, the risk should be tracked to ensure the continued control of the risk. If at any time the risk seems to resurface, the risk management cycle should begin again, starting with the analysis phase.