RAIBR03-BP03 Assign an overall risk level to each potential harm

Create a consistent risk matrix or scoring system that combines likelihood and severity ratings to produce overall risk levels for each potential harm you've identified. Your matrix should define clear categories for both dimensions. For example, use a one to five scale for likelihood (unlikely to likely) and severity (minimal to extreme impact), then combining these to create overall risk ratings like low, medium, high, or critical.

Evaluate the likelihood of each potential harm by considering factors like how often similar issues have occurred in comparable systems, how robust your current mitigations are, and what conditions would need to align for the harm to occur. Be realistic about probabilities rather than assuming your system will work perfectly, and consider both technical failures and misuse scenarios.

Assess the severity of each potential harm by thinking through the full scope of consequences if it were to occur, including immediate impacts on affected individuals, broader effects on communities or society, and long-term damage to trust in AI systems. Consider both direct harms and cascading effects that might result.

Apply your risk matrix consistently across the identified harms to generate comparable risk ratings, and use the same criteria and standards for each assessment. Document your reasoning for each rating so others can understand and review your risk evaluations and consider having multiple people independently assess potential harms that you haven't considered.

Prioritize your risk mitigation efforts based on these overall risk ratings, focusing first on the highest-risk harms while also considering factors like mitigation cost and feasibility. Use these risk levels to guide decisions about which harms need immediate attention, which can be addressed in future iterations, and what level of mitigation investment is appropriate for each type of harm.