This article is part of the Iris Ethics Knowledge Base; you can find a directory of all articles here.
This matrix provides a framework for categorising and documenting the risks associated with a research or evaluation project. Use it when completing the risk assessment section of an ethics application or when reviewing a proposal. It is a quick-reference tool; for the full step-by-step process, including a downloadable risk register template, use the risk assessment checklist.
For substantive guidance see:
Risk categories
| Category | Examples | Typical severity |
|---|---|---|
| Physical harm | Injury, illness, pain, death | Harm |
| Psychological harm | Worthlessness, distress, guilt, anger, fear or anxiety, including from disclosure of sensitive information or re-traumatisation | Harm, or discomfort where mild and transient (NS Chapter 2.1) |
| Devaluation of personal worth | Humiliation, manipulation, disrespectful or unjust treatment | Harm |
| Cultural harm | Misunderstanding, misrepresenting, or misappropriating cultural beliefs, customs or practices | Harm |
| Social harm | Damage to social networks, discrimination in access to benefits or services, stigmatisation, unauthorised disclosure | Harm |
| Economic harm | Direct or indirect costs imposed on participants | Harm |
| Legal harm | Discovery and prosecution of criminal conduct | Harm |
| Discomfort | Mild, transient physical or psychological impact, such as mild anxiety associated with an interview | Discomfort (NS Chapter 2.1) |
| Burden or inconvenience | Time given up to participate, filling in forms, travel costs | Not a risk, but must still be justified by the likely benefit (NS Chapter 2.1) |
All categories are drawn from the classification of potential harms in NS Chapter 2.1 (Risk and benefit). Any harm or discomfort can be experienced by an individual participant, a group, a community, or a non-participant such as a family member.
Risk level determination
- Any foreseeable risk of harm present → full HREC review is required (NS 5.1.11)
- Only foreseeable risk is discomfort, with or without burden → lower risk review pathway is appropriate (NS 5.1.10–5.1.14)
- No risk of harm or discomfort, and meets one of the NS 5.1.17 exemption criteria → a statement of exemption may apply, subject also to the QA Guidance triggers where relevant
Rating likelihood and severity
For each identified risk, rate its likelihood (low, medium, high) and its severity (harm or discomfort, and how serious). Use a simple matrix to keep ratings consistent across a project:
| Likelihood / Severity | Discomfort or burden | Harm | Significant harm |
|---|---|---|---|
| Low | Monitor | Mitigate and monitor; full HREC review | Mitigate and monitor; full HREC review |
| Medium | Monitor | Mitigate and monitor; full HREC review | Mitigate and monitor; full HREC review, enhanced monitoring |
| High | Mitigate and monitor | Mitigate and monitor; full HREC review, enhanced monitoring | Reconsider design; full HREC review, enhanced monitoring |
This rating exercise is a working tool, not a substitute for judgement. A single high-severity risk, however unlikely, can still require full HREC review and careful mitigation.
Documentation guidance
For each identified risk, record: the risk, the population(s) at risk, the likelihood and severity ratings, and the mitigation strategy proposed. Maintaining this as a living risk register, rather than a one-off list, allows the project team to reassess risks as the project progresses and to log any risk occurrences and the response taken. The risk assessment checklist sets out the full workflow, including a downloadable risk management template built around ISO 31000 principles.
This page was last updated on 16 September 2026.
Was this helpful? We'd appreciate your feedback!
This article makes reference to the National Statement on Ethical Conduct in Human Research 2025. It is intended as practical guidance and does not constitute legal advice.
AI Disclosure: Resources in this library were prepared using Large Language Models with input from Iris Ethics staff who guided the scope and design. Subsequent revisions and final versions were developed and approved by Iris Ethics staff.