When is a risk actually a risk that needs capturing?

One of the most common questions I get asked at training sessions is - How do I know if a risk is worth capturing and dealing with formally?

My answer is that, at baseline, all risks are worth capturing formally, however, there are three criteria that will help you in answering this question...

1) Is the risk linked to an objective? - this can be an objective at any level - but I am a firm believer that risks should be linked to at least one objective, be that at a department or organisational level.

2) Score the risk at an inherent level. Assume the worst, score the risk's impact and probability of achieving the objective considering no controls or actions are in place (or they have failed)

3) Now score the current risk position, knowing the controls that are in place

By performing the 3 steps above, this should help answer the question.