The majority of the risk information is gathered and refined in five phases:
Phase 1-structured risk identification workshop-identifying risk
Phase 2-structured risk quantification workshop-quantifying risk
Phase 3-further refinement of the risk quantification by risk experts
The data gathered out of this process is documented in a risk register. This may be a stand-alone document or contained within the public sector comparator financial model. The risk register is likely to be built up from the risk allocation matrix. The risk register differs from the risk allocation matrix in that the risk register contains the data upon which the risk quantification is based.