1. The first step is risk identification, where each business unit, various related activities and important links in the business process are checked and identified repeatedly to see what kind of risks these items have so that an estimate of the risk situation can be made in general and a basic judgment can be made. The most common method of measuring the probability of a random event is the statistical method of a probability distribution, the result of which is the probability of risk. It is also necessary to identify the hazard of the consequences of the risk, i.e. to quantify the tangible and intangible losses, direct or indirect, that will result from the risk. For material losses, estimates using the cost-replacement method can be very accurate, but often monetary units are out of reach when issues such as life, reputation and scope of impact are involved.

2. The second step is risk analysis. The second step in the risk assessment is to analyze carefully the risk characteristics of the projects or processes that are identified as risky, and to describe them in clear definitions so that they can be more precise, especially in terms of numbers or levels of risk, so that people can have a clear idea of the likelihood of their occurrence and the degree of risk they pose. The possibility of occurrence and the consequences of these risks can be better understood. This includes the ability to predict risks. This is a quantitative indicator of the manager’s ability to recognize and control project risks. It also includes an analysis of the time period in which the risk will occur. This is a relevant indicator for determining the probability of risk occurrence and the degree of harm.

3. The third step is the risk assessment. This is a clear and quantitative assessment of the ultimate impact of a business solution, or operational objective, as well as the likelihood and price of the risk, and the possible consequences. There is a need to evaluate risk tolerance, which is subjective and objective, the former indicator perhaps depending on the personality of the investor, while the latter indicator can be measured quantitatively. As well as evaluating the return that can be exchanged for risk. This is the scale or weight used to measure the risk of a project. How much risk an investor is willing to take depends to a large extent on how big the returns are.