This article is part of the Iris Ethics Knowledge Base; you can find a directory of all articles here.
The purpose of risk assessment
Risk assessment in ethical review serves two related purposes: establishing that potential benefits justify any risks and burdens, and determining the appropriate level of ethics review. The second purpose turns on a single distinction: whether the highest foreseeable risk in a project is harm, or only discomfort (NS Chapter 2.1; NS 5.1.10-5.1.11).
The National Statement states that "the risks of a research project must be identified and assessed in order to minimise, mitigate or manage them" (NS Chapter 2.1). Risk assessment is not a one-off exercise completed at the point of application. It is an ongoing responsibility across the life of a project, from design through to data destruction.
What a risk is
The National Statement defines a risk as a potential for harm or discomfort. Assessing a risk involves two elements: the likelihood that the harm or discomfort will occur, and the severity or magnitude of the harm or discomfort, including its consequences (NS Chapter 2.1). Risk exists on a continuum, and the National Statement groups this continuum into four categories to enable proportionate review: minimal, low, greater than low, and high (NS Chapter 2.1, Figure 1). See Harm vs discomfort for how the boundary between these categories is drawn in practice.
Who is responsible
Responsibility for risk assessment is shared among researchers, institutions, and ethics review bodies (NS Chapter 2.1). Researchers are responsible for identifying and assessing risks in their proposals and for describing mitigation strategies. Institutions are responsible for assessing the level of risk of a proposed project, using a designated committee or a suitably experienced individual (NS 5.1.10). Ethics review bodies assess whether the proposed risk management is adequate and, for lower risk pathways, must have the resources and capacity to carry out that review competently (NS 5.1.13).
What risks to consider
In assessing risk, researchers and reviewers should consider only the risks that may result from the research, distinguished from the risks participants would be exposed to if they were not participating in the research (NS Chapter 2.1). This distinction matters in practice: the fact that a study population faces elevated background risks in daily life does not by itself make the research higher risk, unless the research itself contributes to or magnifies those risks.
Risks may be physical, psychological, social, economic, legal, or cultural in nature, or involve a devaluation of personal worth (NS Chapter 2.1). They may be experienced individually or collectively, and harm to non-participants, such as family members of a participant, may also be relevant to the assessment (NS Chapter 2.1). See Risk of harm for the full classification of harm types.
Likelihood and severity
A judgement that research or evaluation is ethically acceptable requires identifying the risks and burdens that may arise, and which participants or others might experience them; assessing the likelihood and severity or magnitude of each risk; describing strategies that could minimise, mitigate, or manage each risk; identifying the potential benefits and to whom they accrue; and determining that risks and burdens are justified by the potential benefits (NS 2.1.1).
A low-probability risk of severe harm may require more mitigation than a high-probability risk of minor discomfort. Assessment should be based on the available evidence, which may be quantitative or qualitative, and researchers/evaluators and reviewers should consider whether to seek advice from others experienced with a similar methodology, population, or research/evaluation domain (NS 2.1.2). The choices, experience, perceptions, values, and vulnerabilities of individual participants or groups of participants are relevant to this judgement (NS Chapter 2.1).
Why this distinction determines the review pathway
Research in which the only foreseeable risk is no greater than discomfort is low risk research. Research in which the foreseeable risk for participants or others is greater than discomfort carries a risk of harm and is not low risk research (NS Chapter 2.1). Where a project is assessed as having more than low risk, it must be reviewed by a Human Research Ethics Committee (HREC) (NS 5.1.11). Where the only foreseeable risk is discomfort, institutions may use a proportionate lower risk pathway instead (NS 5.1.12). This is why the risk assessment in an ethics application needs to identify, clearly and specifically, whether any foreseeable risk of harm exists, not only whether the project involves discomfort, burden, or inconvenience.
Related resources
This page was last updated on 16 September 2026.
Was this helpful? We'd appreciate your feedback!
This article makes reference to the National Statement on Ethical Conduct in Human Research 2025. It is intended as practical guidance and does not constitute legal advice.
AI Disclosure: Resources in this library were prepared using Large Language Models with input from Iris Ethics staff who guided the scope and design. Subsequent revisions and final versions were developed and approved by Iris Ethics staff.