Risks are identified and analyzed to determine their relative importance.

The degree of risk impacts the resources assigned to handle an identified risk and the determination of when appropriate management attention is required.

Analyzing risks entails identifying risks from the internal and external sources identified and then evaluating each identified risk to determine its likelihood and consequences. Categorization of the risk, based on an evaluation against the established risk categories and criteria developed for the risk management strategy, provides the information needed for risk handling. Related risks may be grouped for efficient handling and effective use of risk management resources.