So, in essence, the process is:

1. Identify the risk

2. Rate the probability of it happening - high, medium or low

3. Rate the impact on the business if it happens - high, medium or low

4. List risks in order of high probability and high impact first down to low probability and low impact. This will give you your priority list to work

5. Detail the mitigation that you will implement for each risk

6. Review at regular intervals