This article is part of the Iris Ethics Knowledge Base; you can find a directory of all articles here.
Risk assessment checklist
Use this checklist when preparing a risk assessment for an ethics application, or when reviewing a research/evaluation proposal. All foreseeable risks must be identified and mitigation strategies described (NS 2.1.1).
Step 1: Identify potential harms and discomforts
- Physical harm (injury, illness, pain, death) — is this foreseeable? For which participants?
- Psychological harm (distress, anxiety, re-traumatisation) — is this foreseeable? For which participants?
- Social harm (stigmatisation, re-identification, discrimination, privacy breach) — is this foreseeable? For which participants?
- Economic harm (direct or indirect costs to participants) — is this foreseeable? For which participants?
- Legal harm (exposure to criminal prosecution or liability) — is this foreseeable? For which participants?
- Cultural harm (misrepresentation or misappropriation) — is this foreseeable? For which participants?
- Devaluation of personal worth (humiliation, disrespect) — is this foreseeable? For which participants?
- Harm to non-participants (for example, family members) — is this foreseeable? For which participants?
- Discomfort only, with no reasonable prospect of tipping into distress — document why (NS Chapter 2.1). See Harm vs discomfort for the test to apply.
Step 2: Assess burden and inconvenience
- Time required to participate — how much? Is it proportionate?
- Financial costs (for example, travel) — are they significant? Are they managed through payments?
- Cognitive or emotional effort — is it demanding? Is it reasonable in context?
Burden and inconvenience are not a type of harm or discomfort and are not risks under the National Statement, but they must still be identified and justified against the project's benefits (NS Chapter 2.1). See Risk of inconvenience for detail.
Step 3: Assess likelihood and severity
- For each identified risk, assess: how likely is it? How severe would it be? (NS 2.1.1, NS 2.1.2)
- Are any participants at higher risk than others? Why?
Step 4: Describe mitigation strategies
- How will each foreseeable risk be minimised, mitigated, or managed? (NS 2.1.1)
- What protocols exist for participants who experience unexpected distress?
- Is referral information provided?
Step 5: Determine review level
- If any foreseeable risk of harm is identified → full HREC review required (NS 5.1.11)
- If the only foreseeable risk is discomfort or below → lower risk review pathway available (NS 5.1.10-5.1.12)
- If the research or evaluation meets the NS 5.1.17 criteria and the QA/Evaluation Guidance criteria → exemption may apply (NS 5.1.15-5.1.18)
If you are still unsure which pathway applies, National Statement Navigator provides a more detailed walkthrough for selecting a review pathway.
Ongoing monitoring using a risk register
In research and evaluation, risks often relate to participant recruitment, data integrity, ethical compliance, and stakeholder engagement, in addition to the risks of harm, discomfort, burden, and inconvenience assessed above. A risk register acts as a living catalogue of these risks, showing not only what could go wrong but how the project team plans to prevent or respond to it. It brings structure to uncertainty and supports evidence-based decision-making, and it can also be used to record risk occurrences and responses, supporting learning across projects.
How risk management works
Risk management should be integrated into projects from the outset. This is a requirement under the National Statement: "the risks of a research project must be identified and assessed in order to minimise, mitigate or manage them. Researchers, institutions and ethics review bodies all engage in risk assessment as part of their role in the development of research or the ethics review process" (NS Chapter 2.1).
The National Statement focuses primarily on risks to participants and other stakeholders. Adopting a broader approach to risk management for a project, including non-stakeholder risks such as operational and technical risks, ensures that stakeholder risks remain visible and are considered across the full project lifetime rather than only at the application stage.
Risk management is also something ethics reviewers look for when assessing projects. A clear table of risks and mitigation strategies demonstrates that the project team understands the risks associated with the project and has identified ways to manage them appropriately.
A simple workflow for research and evaluation projects:
- Identify risks early: common examples include recruitment delays, low response rates, or policy changes, as well as the risks of harm, discomfort, burden, and inconvenience covered in Steps 1 and 2 above.
- Log each risk in the register with details: category, description, and potential impact on the project.
- Assess severity using likelihood and consequence ratings. Use a risk matrix for consistency.
- Define mitigation strategies, for example backup recruitment channels, data validation checks, or stakeholder briefings.
- Assign responsibility and track status (not commenced, in progress, implemented).
- Reassess after mitigation to check whether the residual risk is acceptable.
- Use a dashboard to monitor trends, log risk occurrences, and keep the project team informed.
Risk management template
Iris Ethics has published a risk management template containing a dashboard, guide, and risk register that project teams can adapt. It is built around ISO 31000, the international standard for risk management (noting that ISO 31000 is not a legal framework, but a widely used practice standard for identifying and classifying risk mitigation strategies). Download the template and read more at Risk Management Template.
Practical tips for using the template
- Review risks at key milestones: design, data collection, analysis, and reporting.
- Document occurrences and lessons learned to improve future projects.
- Communicate updates with stakeholders to maintain transparency and trust.
Risk management does not need to be complex. With a well-structured risk register and ISO 31000 principles, project teams can navigate uncertainty and deliver robust, credible research and evaluation outcomes.
Related resources
This page was last updated on 16 September 2026.
Was this helpful? We'd appreciate your feedback!
This article makes reference to the National Statement on Ethical Conduct in Human Research 2025. It is intended as practical guidance and does not constitute legal advice.
AI Disclosure: Resources in this library were prepared using Large Language Models with input from Iris Ethics staff who guided the scope and design. Subsequent revisions and final versions were developed and approved by Iris Ethics staff.