It is important to be clear about the purpose and objective of the risk assessment, the scope under consideration, and to define the deliverables. This step should ultimately describe what is to be accomplished, and how, i.e. what tasks and resources are required to meet the risk assessment objectives.

Output

It is recommended to document Stage 1 in a project plan, or similar type of record. The plan should include the following:

• Purpose/objective of the risk assessment (e.g. what will the assessment be used for?)
• Limitations and boundaries (e.g. type of marine accidents, risk and Arctic geographical boundaries)
• Deliverables
• Descriptions of work tasks, schedule and milestones
• Type of assessment (qualitative vs. quantitative, specific methods/tools requested etc.
• Personnel involved, roles and responsibilities (e.g. arctic expertise, risk management experts etc.)
• Project risks that can affect the objectives and deliverables

Risk can be expressed in many different ways, and for most metrics used to describe a risk, there are corresponding risk acceptance criteria. Organizations' specific criteria or industry standards may be used to define the level of risk which is considered acceptable.

The purpose of the risk acceptance criteria is to evaluate the tolerability of risk and to support decision-making processes. Risk acceptance criteria may also be referred to as; risk criteria, acceptability criteria, tolerability limit, safety target etc.

Note that risk acceptance criteria may not be available or implemented in all risk management activities, depending on the objective of the risk assessment.

Output

It is recommended to using, either:

• Risk matrix criteria (e.g. acceptable-green, ALARP-yellow, unacceptable-red), or;
• Individual risk criteria (e.g. location-specific individual risk-LSIR), or;
• Societal risk criteria (e.g. by apply to FN curves), or;
• Custom risk index (e.g. combined with environmental sensitivity)

The context of the risk management process should be established from an understanding of the external and internal environment in which the organization operates and should reflect the specific environment of the activity to which the risk management process is to be applied (ISO 31000:2018).

The external and internal context may not necessarily be recorded, but it is recommended to think through and discuss how the risk assessment objectives “fits” into a larger context, e.g.; has the project necessary commitment from management in the organisation? What is the prioritization over other projects? Is project aligned with company policies? And, also how the deliverables will be perceived and used by others.

Output

Internal context

• Understanding on how the risk assessment aligns with internal relations, objectives and policies

External context

• Understanding the social, cultural, political, legal, regulatory, financial, technological and economic factors, whether international, national, regional or local, that may affect the risk assessment
• External stakeholders’ relationships, perceptions, values, needs and expectations (e.g. what is the risk perception by the public and how will this influence our risk assessment and deliverables?)