1ScopingThe plan, its key assumptions and the risk areas to cover are agreed with the company's team.
2Risk identificationDesk research and internal discussions produce a long list of possible risks, grouped by area. Duplicates are merged and risks with no plausible link to the plan are set aside.
3Evidence gatheringInterviews with customers, suppliers and industry specialists test the most important risks and add views on timing, warning signs and how others in the industry are preparing.
4Rating and scenariosRisks are rated on likelihood and impact, and scenarios show how they could combine.
5Review and monitoring planFindings are reviewed with leadership, and early warning indicators are agreed for ongoing tracking.