In 1973, Ford engineers filed a memo now called the Grush-Saunby report that priced a human life at $200,000 to justify skipping an $11-per-car fix to the Pinto’s fuel tank. The American Museum of Tort Law preserves it as the textbook case of cost-benefit analysis gone cold, and it frames the trap a zero risk assessment is supposed to avoid.
Most organizations err the opposite way, chasing an impossible zero. That instinct is a measurable cognitive bias, not diligence, and a zero risk assessment built to eliminate every risk aims at a target no factory, hospital, portfolio, or network can ever hit.
| Zero Risk Assessment: The Bottom Line |
| Zero risk is unreachable. A zero risk assessment that promises to eliminate every risk is selling a target no real system can deliver. |
| It is a documented bias: in Baron, Gowda and Kunreuther’s 1993 study, 42% preferred a cleanup that prevented fewer cancers because it zeroed one site. |
| The disciplined target is ALARP: reduce risk until further cost is grossly disproportionate to benefit (UK HSE), leaving residual risk you accept on purpose. |
| Good sample questions test the four stages: context and appetite, hazard identification, analysis and scoring, and treatment against a threshold, not against zero. |
| Watch the two failure modes: chasing zero wastes resources on small risks; the Ford Pinto memo shows the opposite error of pricing lives to skip a fix. |
| Assess to a written risk appetite, score on a 5×5 matrix, and document why the residual risk is tolerable, the answer auditors actually want. |
This guide reframes the zero risk assessment honestly, then arms you with sample questions that work. We cover why zero is unreachable, the ALARP target that replaces it, and a four-stage question set that assesses to a tolerable threshold instead of an impossible one.
Why a Zero Risk Assessment Aims at the Wrong Target
Start with the arithmetic the phrase hides. Every operating system carries residual risk after controls, and driving it to zero would demand infinite resources, so the UK Health and Safety Executive’s tolerability model treats zero as a limit you approach, never a state you reach.
Psychology explains why the zero still tempts us. In Baron, Gowda and Kunreuther’s 1993 Risk Analysis study, people ranked a cleanup that prevented five cancer cases above one that prevented six, simply because the weaker option eliminated all risk at one site, the effect The Decision Lab calls zero-risk bias.
Figure 1. The zero-risk bias in one experiment: the option that prevented fewer cancers won support because it hit zero at a single site.
The cost of that instinct is not abstract. Regulatory analyses collected by economists like Viscusi and colleagues show programs chasing near-zero contamination spending orders of magnitude more per life saved than routine interventions, resources that would save more lives deployed elsewhere. A credible risk assessment prices that trade-off openly.
The Target a Zero Risk Assessment Should Use: ALARP
If zero is the wrong target, the right one has a name. The HSE’s ALARP principle, as low as reasonably practicable, says reduce risk until the next increment of cost is grossly disproportionate to the risk it removes, and stop there with eyes open.
Figure 2. The ALARP tolerability triangle: a sound zero risk assessment drives exposure into the broadly acceptable region, not to an unreachable zero.
The model splits risk into three regions, and every finding lands in one of them. Anchoring an assessment to these bands, rather than to zero, is what turns a 5×5 risk matrix score into a defensible decision about whether to treat, tolerate, or escalate.
| Region | What it means | Zero risk assessment response |
| Unacceptable | Risk cannot be justified save in extremes | Treat now or stop the activity |
| Tolerable (ALARP) | Acceptable only if reduction is impractical | Reduce until cost is grossly disproportionate |
| Broadly acceptable | Residual risk so low it is not a concern | Monitor; document why it is tolerated |
Tie the bands to a written risk appetite statement, and the assessment gains a yardstick it otherwise lacks. Appetite converts ALARP from a slogan into concrete numbers a board can approve, which is why sector-specific appetite examples belong beside any zero risk assessment template you adopt or build in-house.
The Four Stages a Zero Risk Assessment Actually Measures
A rigorous zero risk assessment follows the same skeleton as any ISO 31000 process, but it judges each stage against a tolerable threshold rather than perfection. The four stages below map to the sample questions that follow, and to the techniques catalogued in ISO 31010.
| Stage | Question it answers | Threshold it uses |
| Context and appetite | What are we protecting, and how much risk is acceptable? | The written appetite, not zero |
| Hazard identification | What could cause harm, and where? | Completeness, per OSHA and EPA guidance |
| Analysis and evaluation | How likely, how severe, what residual score? | 5×5 matrix banded to ALARP |
| Treatment and monitoring | Reduce, tolerate, transfer, or escalate? | Grossly disproportionate cost test |
Ground the identification stage in recognized method rather than a brainstorm. OSHA’s hazard identification guidance and the EPA’s risk assessment overview both insist on structured discovery over intuition, the same discipline behind a NUDD risk assessment or a HACCP risk matrix, where a missed hazard is the failure that matters most.
Zero Risk Assessment Sample Questions by Stage
Here is the practical core, the sample questions readers came for, organized so each one tests whether you are managing to a threshold or chasing an impossible zero. Use them in workshops, audits, or interviews the way a vendor risk questionnaire structures third-party review.
Context and Appetite Questions for a Zero Risk Assessment
| Sample question |
| What objective or asset is this assessment protecting, in one sentence? |
| What level of residual risk has leadership stated it will accept here? |
| Where does ‘as low as reasonably practicable’ sit for this activity? |
| What would we spend to remove the last increment of risk, and is it proportionate? |
Hazard Identification Questions for a Zero Risk Assessment
| Sample question |
| What hazards exist across people, process, technology, and environment? |
| Which failure modes have caused loss here or at a peer organization? |
| What could a hostile or careless actor exploit that we have not listed? |
| Which hazards are we tempted to ignore because they feel already ‘zero’? |
Analysis and Evaluation Questions for a Zero Risk Assessment
| Sample question |
| How likely is each hazard, and how severe, on our 5×5 scale? |
| What is the residual score after existing controls, not the inherent score? |
| Which ALARP region does each residual risk fall into? |
| Are we over-investing to zero out a small risk while a larger one stays amber? |
Treatment and Monitoring Questions for a Zero Risk Assessment
| Sample question |
| For each risk, will we treat, tolerate, transfer, or escalate, and who owns it? |
| Is the cost of further reduction grossly disproportionate to the benefit? |
| What indicator will tell us the residual risk is drifting before an incident? |
| When and on what trigger will this zero risk assessment be reviewed? |
Adapting the Zero Risk Assessment Across Domains
The four-stage skeleton travels, but the hazards and thresholds change per domain, so the sample questions need local anchors. A cyber risk assessment framework leans on NIST SP 800-30, while a safety assessment leans on OSHA, and both still reject zero as the target.
Figure 3. The disproportion a zero risk assessment must respect: chasing near-zero can cost thousands of times more per life-year saved.
| Domain | Where the threshold sits | Anchor method |
| Workplace safety | ALARP under HSE-style regulation | OSHA hazard identification |
| Cybersecurity | Appetite-driven residual risk | NIST SP 800-30, CRAMM |
| Financial and pension | Loss tolerance and limits | Monte Carlo simulation |
| Food and manufacturing | Critical control points | HACCP matrix scoring |
| Climate and geopolitical | Scenario-based tolerances | Scenario and transition analysis |
Match the method to the domain and the sample questions sharpen accordingly. Portfolio teams price tail risk with Monte Carlo simulation, security teams borrow CRAMM logic, and strategy teams run geopolitical and climate transition scenarios, yet none of them promises zero, and none pretends the residual has vanished.
Zero Risk Assessment Sample Questions: Your Questions Answered
What is a zero risk assessment, really?
It is a risk assessment framed around the aspiration of eliminating risk, but the honest version manages risk to a tolerable level rather than to zero. Treat the phrase as shorthand for a maximally rigorous assessment that drives residual risk into the broadly acceptable region, not a promise that no risk remains.
Can any zero risk assessment actually reach zero risk?
No, and any tool claiming otherwise is misleading. Every real system retains residual risk after controls, and the cost of removing the last fraction rises toward infinity. The credible goal is ALARP, reducing risk until further spending is grossly disproportionate to the benefit gained.
What are good zero risk assessment sample questions to start with?
Begin with context: what are we protecting, and what residual risk has leadership accepted? Then move through hazard identification, 5×5 analysis of residual scores, and treatment against a threshold. The full staged question set sits in the tables above, ready to drop into a workshop or audit.
How is zero-risk bias different from caution?
Caution weighs cost against benefit; zero-risk bias ignores it. The bias, documented since Baron’s 1993 study, makes people over-invest to eliminate one visible risk while larger diffuse risks go untreated. A disciplined zero risk assessment names the trade-off so the bias cannot drive the budget.
How often should a zero risk assessment be reviewed?
Set triggers, not just a calendar. Review when the context changes, a control fails, an incident occurs, or a monitored indicator drifts, and at least annually as a floor. Tying review to appetite breaches keeps the assessment live rather than a document filed once and forgotten.
Which standards support a zero risk assessment?
ISO 31000 provides the process, ISO 31010 the techniques, and NIST SP 800-30, COSO ERM, and HSE ALARP guidance supply domain depth. None endorses zero as a target; all frame risk as something to be understood, treated, and tolerated within an appetite you have written down.
Does a zero-risk target ever make sense?
Only for catastrophic, irreversible harms where society sets a near-zero tolerance, such as certain nuclear or aviation failure modes. Even there, regulators use ALARP and defense-in-depth, not literal zero, because infinite spending on one hazard starves the controls that address others.
Where Zero Risk Assessment Programs Go Wrong
Most flawed assessments we review fail in one of the ways below, and the fixes are cheaper than the incident or the wasted budget. The pattern is consistent because the causes are cognitive, the same reason a risk matrix generator helps only if the thresholds behind it are honest.
| Pitfall | Root cause | Fix |
| Promising zero | Marketing language over method | Assess to ALARP; state the residual risk |
| Gold-plating small risks | Zero-risk bias driving spend | Rank by residual score, fund the top band first |
| Ignoring the appetite | No written tolerance to judge against | Adopt a risk appetite statement first |
| Inherent-only scoring | Controls not credited | Score residual risk after existing controls |
| Cost-blind cuts (the Pinto error) | Lives priced to skip a cheap fix | Weight severity and ethics, not just dollars |
| One-and-done | Assessment filed, never revisited | Trigger-based review tied to indicators |
Where Zero Risk Assessment Thinking Is Heading
Put quantification at the top of the watchlist for the next few years. Boards increasingly want residual risk expressed in money and probability, not traffic-light colors, and HBR’s risk framework pushed that shift years ago; simulation tools now make it routine even for mid-size organizations on modest budgets.
Behavioral design is the second shift. Assessment templates are starting to build in bias checks, prompting teams to ask whether a control exists to remove real risk or merely to feel the comfort of zero, a lesson traceable to Kahneman’s work on how we misjudge probability.
Figure 4. Four numbers that reframe the zero risk assessment: the bias, the model, the cautionary memo, and the honest answer.
Regulation is the third force. Aviation and process-safety regulators already audit ALARP reasoning, and safety management system expectations are spreading into new sectors, so documenting why residual risk is tolerable is becoming the deliverable auditors demand, as GAO reviews of federal programs show.
Our position after years of these reviews is plain: a zero risk assessment earns its name by being the most rigorous assessment in the room, not by promising a zero it cannot deliver. Assess to appetite, score the residual, and document the tolerance, using an Excel risk matrix or a physical security assessment report as your working template.
Run a Better Zero Risk Assessment With Risk Publishing
Risk leaders bring us the same two problems: assessments that promise too much and thresholds nobody wrote down. Explore our services for the frameworks behind this guide, or contact our team to turn these sample questions into a zero risk assessment your board will trust.
Chris Ekai is a Risk Management expert with over 10 years of experience in the field. He has a Master’s(MSc) degree in Risk Management from University of Portsmouth and is a CPA and Finance professional. He currently works as a Content Manager at Risk Publishing, writing about Enterprise Risk Management, Business Continuity Management and Project Management.