A risk assessment policy that classifies and evaluates the likelihood, impact and timing of each risk and discloses the results on an ongoing basis. It addresses how risk information is assessed and disclosed, rather than individual risk events such as disasters, accidents or environmental pollution.