In this article
Before you start
If you are preparing for behavioral interview questions, this page answers one of them in full: the reasoning, a sample answer and the follow-ups.
Why interviewers ask this
Interviewers ask how you analyze risk because the answer shows how you decide when the outcome is uncertain. A bare "I am careful" tells them nothing. A story with a clear order of thinking tells them how you would act on their team. Candidates report it in behavioral rounds at large tech companies.
A weak answer lists adjectives: "I weigh pros and cons and go with my gut." A strong answer names a concrete risk, says how likely and how costly it was, and says what was done. A Staff-level answer adds what was accepted on purpose, which early signal was watched, and what changed afterward. Advice on structure for any question is in how to answer interview questions.
Risk analysis from first principles
- Risk
- A risk is an uncertain event that, if it happens, helps or harms a goal, described by how likely it is and how large its effect would be. Guides such as the International Organization for Standardization (ISO) standard ISO 31000 frame risk as the effect of uncertainty on objectives.
- Risk register
- A risk register is a written list of the risks of a piece of work, each with its likelihood, its impact, an owner and the chosen response, kept up to date so the team can review it at any point.
In plain words
Think of checking the weather before a picnic. You ask what could go wrong, rain is the answer, then how likely it is and how much it would spoil the day. Then you decide: bring a tarp, move the date or go anyway. The analogy breaks in one place. Picnics rarely have a team that needs your reasoning, so work risk needs the reasoning written down.
In one precise sentence, risk analysis estimates the likelihood and the impact of each possible event so that responses can be chosen by size of effect. Likelihood is how probable the event is. Impact is how much the goal would lose if it happened. The National Institute of Standards and Technology (NIST) guide to risk assessments treats risk in the same way, as a combination of the two. The four steps below run in order: identify, estimate, compare, respond. Written down, ISO 31000 describes the same sequence as identification, analysis and evaluation, followed by treatment.
Step 1: Identify what could go wrong
Write every plausible risk to the goal, without scoring anything yet. Ask three questions: what depends on something outside our control, what has never been done by this team, and what breaks the plan if one person leaves. The output is a list, the first draft of a risk register.
Input: the goal and the plan. Output: a list of named risks, each in one sentence of the form "if X happens, then Y suffers". Listing first and scoring later prevents the habit of dropping a risk because it feels unlikely. You now have candidates; the next step turns each into numbers.
Step 2: Estimate likelihood and impact
For each risk, give a likelihood and an impact. Use rough numbers when you can: a chance such as one in five, and a loss in a unit your team already tracks, such as days of delay. When you cannot, use three levels, low, medium and high, and say what each means.
Take three illustrative risks on a data migration: a vendor delay, a migration slip and a key person leaving.1 The vendor delay has a thirty percent chance of a ten person-day loss. The migration slip has a twenty percent chance of a fifty person-day loss. The key person leaving has a five percent chance of an eighty person-day loss.1 Input: the list. Output: two numbers per risk. Estimates are judgment, so write the reasoning beside each one.
Step 3: Compare the cost of acting with the cost of waiting
Multiply likelihood by impact to get the expected loss of each risk, then compare it with what a response would cost. In the illustrative example the migration slip has an expected loss of 10 person-days; the vendor delay has 3 and the key person leaving has 4.1 The slip comes first.
Now test a response. Four person-days of extra testing would cut the slip's chance from 20% to 5%, leaving an expected loss of 2.5 person-days. Acting costs 4 plus 2.5, which is 6.5, against 10 for doing nothing, a net benefit of 3.5 person-days.1 The response only pays if the chance falls by more than 8 percentage points, which is the cost of 4 divided by the impact of 50.1 A drop from 20% to 15% would not justify it. This comparison is the answer to the interviewer's next question.
Text description of the diagram
- Acting costs 4 plus 2.5, which is 6.5, against 10 for doing nothing.
- The response only pays if the chance falls by more than 8 percentage points.
Step 4: Respond, accept on purpose and review
Pick one response per risk: reduce it, avoid it, share it with someone else or accept it. Reducing might be extra testing, avoiding might be dropping the risky feature from the launch, sharing might be moving the work to a vendor under contract, and accepting might be doing nothing and noting why. Write down the risks you accept and why, name one early signal that a risk is becoming real, and set a date to review. Risk analysis is not a one-time step; ISO 31000 places monitoring and review alongside the other activities for that reason.
Input: the compared risks. Output: an owner, a response and a review date for each risk worth acting on. Saying aloud which risks you left alone is what separates a considered answer from a cautious-sounding one.
Step-by-step description
- List what could go wrong.
- Give likelihood and impact.
- Acting versus waiting.
- Act, accept, then review.
- The four steps run in order: identify, estimate, compare, respond.
- Compare the cost of acting with the cost of waiting.
Why a risk matrix is not enough
A risk matrix puts each risk in a grid of likelihood and impact levels. It is quick, but the levels are coarse. In the illustrative example, on a three-level scale the vendor delay (high likelihood, low impact) and the key person leaving (low likelihood, high impact) both score 3, though their expected losses are 3 and 4 person-days.1 Cox (2008) examines how risk matrices can rank risks poorly. Cox's concern includes range compression: one cell can hold risks whose real sizes differ many times over, so the grid hides the difference that should decide the order. Use a matrix to start the conversation and numbers to decide.
Knowing it is half the job. Saying it is the other half.
Interview Clozo is an AI interview copilot for real interview rounds: it hears the question and puts a strong answer on your screen, and you say it in your own words. See the features or how it works.
Start Free Trial →The Staff-level answer
How do you analyze risk?
I start by writing down what could go wrong with the work, then I score each item on how likely it is and how much it would cost us, using rough numbers instead of high, medium and low when I can. On a data migration I found a one in five chance of losing about fifty person-days. Four person-days of extra testing cut that to one in twenty, so I paid for it; that took the expected loss from ten days to six and a half, cost included. I told the team which risks I was accepting, named one early signal to watch, and reviewed the list weekly. Afterward I added that signal to our launch checklist.
This is an illustrative example answer, not a script. It is Staff-level because it states the cost of acting beside the cost of waiting, names what was accepted, and says what changed in the team's process afterward. Say it in about a minute and keep your own facts.
The rubric
| Dimension | Weak answer | Strong answer | Staff answer |
|---|---|---|---|
| Structure | "I weigh pros and cons." | Names the steps in order | Names the steps and why the order matters |
| Evidence | No example | One real example with the risk named | Example with likelihood and impact stated |
| Trade-off | Not mentioned | Says what mitigation cost | Compares the cost of acting with waiting |
| Ownership | "The team handled it." | Says what you did | Says what you accepted and what you watched |
| Follow-up readiness | Stalls on "why that response?" | Explains the choice | Gives the break-even point and what would change your mind |
Three variants of this question
What is your process for assessing risk before a big decision?
Describe the four steps in order and tie each to the decision at hand. Lead with the comparison of acting and waiting, because it explains why you chose what you chose.
Tell me about a time you took a calculated risk.
Use the STAR method: the situation and the risk, your task, the analysis you did (likelihood, impact, cost of acting), and the result. End with what you would estimate differently now.
How do you decide whether a risk is worth taking?
A risk is worth taking when its expected gain, minus its expected loss and the cost of reducing that loss, beats the best alternative. Say what you would do if the downside were unrecoverable, because that case breaks a purely numeric rule.
The same habit of showing your reasoning carries over to other open questions, such as what your greatest weakness is and why they should hire you.
Common mistakes
- "I just go with my gut." (wrong) This hides the reasoning the interviewer wants. (right) "I list the risks, estimate likelihood and impact, and compare the cost of acting with waiting."
- "I avoid risk." (wrong) Avoiding every risk also avoids the upside, and the question asks how you analyze, not how you refuse. (right) "I choose which risks to reduce, share or accept, and I say why."
- "High, medium, low is my whole analysis." (wrong) Coarse levels can tie risks that differ in size. (right) "I use rough numbers where I can and levels only to start."
- "I analyzed it once and moved on." (wrong) Risks change as work proceeds. (right) "I named an early signal and set a review date."
- A story with no result. (wrong) The interviewer cannot judge the analysis. (right) End with what happened and what you changed.
Follow-up questions
How do you prioritize several risks at once?
Rank them by expected loss, likelihood times impact, then adjust for risks that cannot be undone or that block other work. In the illustrative example the migration slip leads with 10 person-days, ahead of 4 and 3.1
How do you analyze risk in a project?
Keep a risk register for the project: list the risks, score each, assign an owner and a response, and review it on a fixed schedule. Link it to the plan so a risk that becomes real changes the plan.
What is the difference between risk analysis and risk assessment?
In the framing of ISO 31000, risk assessment is the larger process of identification, analysis and evaluation, and analysis is the step that estimates likelihood and impact. In everyday interviews the terms are often used interchangeably, so define yours in one sentence.
What do you do when you cannot estimate a probability?
Use ranges or levels, say they are judgment, and test how the decision changes across the range. If the choice is the same at both ends, the exact number does not matter. For wording the answer aloud, see how to answer interview questions.
- Analyze risk in four steps: identify, estimate, compare acting with waiting, then respond and review.
- Likelihood times impact gives an expected loss you can compare with what a response costs.
- A response pays only if the loss it removes exceeds what it costs; state the break-even point.
- Say which risks you accepted on purpose and which signal you watched.
- Use a matrix to start the discussion, and numbers to decide.
Sources
- Guide for Conducting Risk Assessments (NIST SP 800-30 Rev. 1) — National Institute of Standards and Technology, 1 Sep 2012
- ISO 31000:2018 Risk management: Guidelines — International Organization for Standardization, 1 Feb 2018
- What's Wrong with Risk Matrices? (Risk Analysis 28(2)) — Risk Analysis (Cox), 1 Apr 2008
