---
title: "What is the Difference Between Risk Analysis  and Risk Evaluation?"
url: "https://help.decipherrisk.com/en/article/what-is-the-difference-between-risk-analysis-and-risk-evaluation"
language: "en"
last_updated: "2025-11-19T19:41:46.471Z"
---

# What is the Difference Between Risk Analysis  and Risk Evaluation?

In the ISO 31000 risk management framework, **risk analysis** and **risk evaluation** are distinct, sequential steps in the overall risk assessment process. Understanding the difference is essential for using DecipherRisk effectively in a healthcare cybersecurity context.

### **Risk Analysis: Understanding the Risk**

**Purpose:** Risk analysis is the process of **understanding the characteristics of a risk**, including its causes, consequences, likelihood, and existing controls.

**Key Activities:**

-   **Identifying** **consequences** (e.g., patient safety, compliance fines, data integrity failures).
-   **Estimating** **likelihood** using scenarios, historical data, or simulation.
-   **Identifying root causes** (e.g., misconfigured access controls, unpatched vulnerabilities).
-   **Reviewing** **effectiveness of existing controls** (e.g., MFA, network segmentation, EDR).
-   **Calculating/estimating the level of** **risk**, such as Value at Risk or FAIR-based estimates in DecipherRisk.

ISO Quote: *"The purpose of risk analysis is to understand risk. This includes understanding the consequences to objectives, their likelihood, causes, and existing controls… and where appropriate, obtaining a level of risk." — ISO 31000:2018 Practical Guide, §4.5.3*

**Example:**   A security analyst uses the **Risk module** to model a ransomware threat. They enter the asset (e.g., EHR system), impact categories (e.g., financial reporting delay, patient safety, compliance exposure), and likelihood factors to calculate an estimated annualized loss exposure using the Open FAIR model.

### **Risk Evaluation: Judging Significance**

**Purpose:** Risk evaluation is the process of comparing the results of analysis against **defined risk criteria** to decide whether the risk is significant and what to do about it.

**Key Activities:**

-   **Comparing each risk’s impact and likelihood against** **organizational risk criteria** (e.g., thresholds for financial loss, patient safety tolerance).
-   **Determining risk requirements**:  treatment, acceptance, or escalation.
-   **Prioritizing risks for mitigation** based on strategic and operational impact.
-   **Supporting** **resource allocation and decision-making** for mitigation or acceptance.

ISO Quote: *"The results of risk analysis can be compared with risk criteria to determine the significance of risk. An understanding of risk and its significance is relevant to any decision, including whether to treat a risk or not." — ISO 31000:2018 Practical Guide, §4.5.4*

**Example:** A CISO views the executive risk dashboard. One risk—unauthorized access to clinical imaging systems—has a quantified loss of $1.2M and impacts multiple domains (patient safety, regulatory compliance). Based on the hospital's predefined thresholds, this risk exceeds the acceptable criteria. It is flagged for **mandatory treatment** and assigned to the infrastructure team via an **Action Plan**.

### **How Risk Analysis and Risk Evaluation Work Together**

| **Step** | **Purpose** | **Questions Answered** |
| --- | --- | --- |
| **Risk Analysis** | Understand the risk | What is the risk? How bad could it be? How likely is it? |
| **Risk Evaluation** | Judge its significance and decide what to do | Is the risk acceptable? Do we need to act? Who needs to know? |

  
 

### **In Practice with DecipherRisk**

-   **Risk Analysis** is done primarily in the **Risk** and **Issue** modules, where analysts estimate loss exposure and examine contributing factors.
-   **Risk Evaluation** is conducted using risk criteria defined in the **Scope, Context, and Criteria** phase. Evaluation happens in both the **dashboard** and **reporting outputs**, where risks are prioritized, escalated, or accepted based on thresholds.

*Risk evaluation is where decisions are made. Risk analysis is what informs those decisions.*

### **Related Resources**

-   [Core Modules and Workflow User Guide](https://help.decipherrisk.com/en/article/core-modules-and-workflow-user-guide#core-modules)
-   [Pro Tip: Core Workflow Triage Process](https://help.decipherrisk.com/en/article/pro-tip-core-workflow-triage-process)
-   [Improving Decisions with DecipherRisk™️ Cost-Benefit Analysis (Scenario Cloning and Comparisons Features)](https://help.decipherrisk.com/en/article/improving-decisions-with-decipherrisk-cost-benefit-analysis-scenario-cloning-and-comparisons-features)