Document code:  PRO-0027.06  Security level:  Internal  Effective date:  15/01/2019  ICT Governance  TEM-0129.01  Uncontrolled copy once printed. Ensure that the right version is in use.  Page  77  of  92 The risk assessment workflow and its phases  The IT Security risk assessment methodology applied at ECHA contains following phases:  The purpose of the security risk assessment is to identify, evaluate and categorize any  relevant security risks, including liability risks, operational disruptions, reputational harm  and financial loss. Effective risk management requires assessment of inherently uncertain  events and circumstances, typically addressing two dimensions: how likely the uncertainty  is to occur (probability), and what the effect would be if it happen (impact).  The central idea of ECHA’s iterative life -cycle model is that IT Security is continuously  improved and developed in this continuous cycle. 3.13.2. IT Security Risk Assessment