This article is part of the Iris Ethics Knowledge Base; you can find a directory of all articles here.
Overview
These worked examples illustrate risk assessment across a range of research and evaluation contexts. Each is a hypothetical, generic scenario; it does not describe a real Iris Ethics application. For the risk assessment framework, see Assessing risk and benefit (NS 2.1), Risk of harm, Risk of discomfort, and Harm vs discomfort.
Case study: Standard quantitative consumer survey
Description: 1,000 adults are recruited via an online panel to complete a 15-minute survey on grocery shopping habits. Topics are non-sensitive. No identifying information is collected beyond postcode and demographic categories.
Risk assessment: Foreseeable risks are burden and inconvenience (time to complete) and mild discomfort (effort). No foreseeable risk of harm. Re-identification risk is low given the non-sensitive topic and aggregate reporting. The design may meet the NS 5.1.17(b) exemption criterion (surveys using non-identified information that are highly unlikely to cause distress), though committees will look closely at whether postcode combined with demographic categories could re-identify individuals in small geographic areas. Risk level: lower risk. Review pathway: Lower risk review, possibly exemption if NS 5.1.17(b) criteria are clearly met.
Case study: Focus groups on experiences of racism
Description: Six focus groups with members of minority ethnic communities, exploring experiences of racism in healthcare settings. Participants are recruited through community organisations. Data will be audio recorded.
Risk assessment: Foreseeable risks include psychological distress from revisiting experiences of racism, social risk (the group setting may compromise confidentiality if participants recognise each other's voices in shared materials), and re-identification risk from audio recording. The topic and population create a foreseeable risk that participants' reactions may exceed discomfort and constitute harm (NS 1.6, 1.8: where there is no direct benefit to participants, the risk threshold that is acceptable is lower). Risk level: harm. Review pathway: Full HREC review.
Case study: Small regional community needs survey
Description: A local council commissions a needs assessment survey of residents in a town of 4,000 people, collecting age, household composition, income bracket, and views on council services, with results to be presented at a public council meeting.
Risk assessment: The topics themselves are not sensitive, but the small population size raises identifiability risk: a combination of demographic attributes may allow specific residents to be identified within a small community, particularly once findings are made public (identifiability exists on a continuum and is affected by the size of the population, not only by the presence of direct identifiers). Public presentation of results at a council meeting increases this risk relative to an internal report. Mitigations include coarser demographic categories, minimum cell-size suppression in any disaggregated reporting, and review of the public report before release. See Privacy and identifiability and Risk of harm.
Risk level: lower risk, contingent on aggregation and reporting safeguards. Review pathway: Lower risk review, with specific conditions on public reporting.
Related resources
This page was last updated on 16 September 2026.
Was this helpful? We'd appreciate your feedback!
This article makes reference to the National Statement on Ethical Conduct in Human Research 2025. It is intended as practical guidance and does not constitute legal advice.
AI Disclosure: Resources in this library were prepared using Large Language Models with input from Iris Ethics staff who guided the scope and design. Subsequent revisions and final versions were developed and approved by Iris Ethics staff.