New Thought Paper: Simplifying Risk Prioritization

How do organizations accurately identify and prioritize their most significant risks—without getting bogged down by overly complex scoring systems?

In her latest thought paper, Bonnie Hancock, professor of practice in NC State’s Poole College of Management, explores a practical technique that simplifies the risk assessment process: forced risk rankings.

This method challenges the traditional use of likelihood and impact scoring scales and offers a faster, more intuitive way to rank top risks—one that brings greater clarity and separation between them.

?Key Takeaway for Risk Leaders

Simplifying the risk assessment process can lead to greater clarity, faster decisions, and stronger risk oversight—especially when prioritization is paramount.

The Problem with Traditional Risk Scoring

Most organizations assess risks by evaluating:

• Likelihood: How likely is the risk to occur?
• Impact: If it occurs, how significant will the impact be?

Using 1–5 point scales, risk managers assign scores, often calculating a product (L x I) to determine overall risk ranking. But there’s a downside:

• Risk scores often cluster around the midpoint due to averaging.
• Individuals unsure about specific risks tend to default to “3” ratings.
• This leads to minimal variation between risk scores—for example, little separation between risk #5 and risk #15.

While this approach may seem objective, the outcome can obscure the true priority of risks.

A Simpler Alternative: Forced Rankings

To improve clarity and reduce subjectivity, Hancock proposes an alternative:

“Rather than scoring each risk on two dimensions, ask leaders to rank their top 10 risks—and assign points accordingly.”

How this Works: Each individual ranks their top 10 risks. Points are assigned in reverse order:

• 1st risk = 10 points
• 2nd = 9 points
• …
• 10th = 1 point

Total scores across all individuals are summed and rank ordered, providing a clearer picture of priority risks.

Why Forced Ranking Works:

• No scales required — Simplifies participation
• Faster execution — Saves time during workshops or surveys
• Greater score differentiation — More separation between top and lower-tier risks
• Adaptable — Useful across management levels (e.g., Board, C-Suite, VPs)

Even with its subjective nature, forced ranking often yields more useful insights than traditional scaling — particularly when comparing risk perspectives across demographics or organizational levels.

When Might This Not Work?

In some instances, individuals may prefer numerical scoring—especially if they need structured dimensions like likelihood and impact. That’s okay. The key is to tailor your risk assessment approach to fit your organization’s culture and needs.

Related Resources

If you found this article useful, you may also like:

Original Article Source: “A Simpler Way to Assess Risks?,” Bonnie V. Hancock, NC State University ERM Initiative, updated 2025.

About Bonnie Hancock: Bonnie Hancock is Professor of Practice in the Poole College of Management, while also serving on a number of boards of directors of organizations. She consults with organizations on ERM implementations for strategic value. That hands-on advising leads to insights about techniques useful in addressing a number of practical challenges associated with ensuring ERM processes are value adding without over burdening the process. In this article, Bonnie addresses techniques that might simplify the process of prioritizing risks.