Skip to main content
Regulatory Council
green gradient background, "The Future of Application Security Is Already Here." and a read the report button.
Category: Risk Assessment & Analysis

Consequence Analysis

Also known as: Offsite Consequence Analysis (OCA)
Simply put

Consequence analysis is a way of studying what could actually happen if a hazardous event occurs, for example, how far the effects of a fire, explosion, or toxic release might spread and who or what could be harmed. It focuses on the severity and reach of potential outcomes rather than on how likely they are to happen. It is most commonly used in process safety and industrial risk settings.

Formal definition

Consequence analysis is a hazard assessment that estimates the extent, magnitude, and effects of the outcomes arising from a defined set of episodic hazardous events, such as fires, explosions, and toxic releases. It typically involves modeling one or more release or event scenarios to characterize impact zones and effects on people, assets, or the environment, and it addresses the 'consequence' dimension of risk rather than event likelihood. In certain regulatory contexts, a structured form known as offsite consequence analysis (OCA) evaluates defined scenarios, often including a worst-case release scenario alongside alternative release scenarios, to assess potential impacts beyond facility boundaries. The specific scenarios, modeling assumptions, and applicable requirements vary by jurisdiction, sector, and the governing regulatory or industry framework, and should be verified against the primary source before application.

Why it matters

Consequence analysis matters because understanding how likely an event is to occur tells only half the story of risk; the other half is understanding what would actually happen if it did. In process safety and industrial risk settings, a hazardous event such as a fire, explosion, or toxic release can produce effects that extend well beyond the point of origin, potentially harming workers, nearby communities, assets, and the environment. By focusing on the severity and reach of outcomes rather than their probability, consequence analysis gives organizations a clearer picture of the magnitude of harm they may need to prevent, mitigate, or plan around.

This focus on outcomes supports several downstream decisions. It can inform the design of safety systems and controls, emergency response and evacuation planning, facility siting and spacing, and communication with regulators and the public. In certain regulatory contexts, a structured form known as offsite consequence analysis (OCA) is used specifically to evaluate impacts beyond a facility's boundaries, typically examining a worst-case release scenario alongside alternative release scenarios. This helps organizations and authorities anticipate how far effects might travel and who could be affected.

It is important to recognize what consequence analysis does not do: on its own it does not measure how likely an event is, nor does it eliminate risk. Its value lies in characterizing potential impact so that likelihood and consequence together can inform proportionate risk treatment. The specific scenarios required, the modeling assumptions considered acceptable, and the governing obligations vary by jurisdiction, sector, and framework, so results should always be interpreted against the applicable primary source.

Who it's relevant to

Process Safety and Risk Engineers
Those responsible for identifying and assessing industrial hazards use consequence analysis to model the extent and severity of potential fires, explosions, and toxic releases, informing the design of controls, safety systems, and facility layout.
Environmental, Health, and Safety (EHS) Compliance Teams
Teams managing obligations under process safety and chemical release regulations may need to prepare or review offsite consequence analyses, including worst-case and alternative release scenarios, to satisfy applicable requirements. The specific obligations vary by jurisdiction and should be confirmed against the primary source.
Emergency Planning and Response Coordinators
Those planning for emergencies rely on consequence analysis to understand how far hazardous effects might spread and who could be affected, supporting evacuation planning, response resourcing, and coordination with local authorities and communities.
Risk Managers and Governance Stakeholders
Risk managers use the consequence dimension that this analysis provides, alongside likelihood assessments, to characterize risk and inform proportionate treatment decisions. It supports, but does not by itself constitute, a complete risk evaluation.

Inside Consequence Analysis

Consequence Identification
The process of determining the range of potential outcomes that could result if a risk event materializes, spanning financial, operational, reputational, legal, safety, and strategic effects on objectives. In many frameworks, consequences are considered across multiple categories rather than a single dimension.
Consequence Severity Scale
A defined scale or set of descriptors used to rate the magnitude of an outcome, often ranging from insignificant to catastrophic. The scale is typically calibrated to the organization's context, and the same event may map to different severities depending on the objective affected.
Basis of Assessment
The stated assumptions, data sources, and conditions under which consequences are estimated, including whether the analysis reflects inherent effects (before controls) or residual effects (after controls). Making this basis explicit supports defensibility and comparability.
Relationship to Likelihood
Consequence analysis addresses the effect of an event, while likelihood analysis addresses its probability of occurrence. In many risk assessment methods the two are considered together to characterize a level of risk, but consequence analysis on its own concerns only the effect side.
Multi-Category and Aggregate Effects
Consideration of how a single event may produce effects across several categories simultaneously, and how consequences may aggregate or cascade. This helps avoid understating an outcome by viewing it through only one lens.
Uncertainty and Range
Recognition that consequences are typically estimated within a range rather than a single point, reflecting uncertainty in data and assumptions. Documenting a plausible worst case alongside a most-likely case is a common convention.

Common questions

Answers to the questions practitioners most commonly ask about Consequence Analysis.

Is consequence analysis the same as assessing how likely a risk is to occur?
No. Consequence analysis concerns the nature and magnitude of the effects should a risk event materialize, not the probability that it will occur. Likelihood and consequence are typically treated as distinct dimensions of risk in many frameworks, and combining them is generally a separate step (often described as risk evaluation or estimation). Analyzing consequences answers 'how bad could the outcome be,' while likelihood analysis answers 'how probable is it,' and both are usually needed to characterize a risk fully.
Does consequence analysis only address financial impact?
No. While financial effects are commonly considered, consequences frequently span multiple dimensions, which may include operational disruption, reputational harm, legal and regulatory exposure, health and safety effects, and impact on strategic objectives. Limiting the analysis to monetary terms can understate the significance of an event. Many organizations use multiple impact categories or scales so that non-financial consequences are captured alongside financial ones, though the specific categories vary by organization and context.
What information is typically needed to perform a consequence analysis?
Analysts generally draw on a description of the risk event or scenario, the objectives or assets that could be affected, and information about how effects might propagate. Relevant inputs often include historical incident data, expert judgment, process and dependency mapping, and any existing controls that could modify the outcome. The quality of the analysis typically depends on how well the scenario and its potential pathways are understood; where data is limited, qualitative or expert-based estimation is common, and its assumptions should be documented.
How can consequences be expressed when the effects are difficult to quantify?
Where precise quantification is impractical, organizations often use qualitative or semi-quantitative scales, such as descriptive severity bands (for example, minor through severe) tied to defined criteria for each impact category. Consistent definitions for each band help make ratings comparable across risks. Some frameworks combine qualitative descriptors with indicative ranges. The chosen approach typically depends on the maturity of available data, the purpose of the analysis, and the level of rigor the decision requires.
Should consequence analysis consider effects before or after controls are applied?
This depends on the purpose. Analyzing consequences on an inherent basis (before considering the effect of controls) can help illustrate the raw significance of an event, while a residual basis (after accounting for controls that modify the effect) reflects the situation the organization actually faces. Many practitioners find value in both perspectives, and it is generally important to state explicitly which basis a given consequence estimate reflects, since conflating them can distort comparisons.
How does consequence analysis connect to risk appetite and decision-making?
Consequence estimates typically feed into risk evaluation, where results are compared against criteria that may be informed by an organization's risk appetite and tolerance. Understanding potential consequences can help prioritize which risks warrant treatment and inform the selection of controls or other responses. Because appetite and tolerance are set by the organization and vary by context, the same consequence rating may prompt different responses in different organizations, and decisions involving legal or regulatory exposure often warrant professional advice.

Common misconceptions

Consequence analysis is the same as assessing overall risk.
Consequence analysis addresses only the effect side of a risk. In many risk assessment methods, a level of risk is characterized by combining consequence with likelihood, so consequence alone does not represent the full risk picture.
Consequences should be measured in financial terms only.
Effects on objectives often span multiple categories, such as operational, reputational, legal, and safety impacts. Reducing consequence to a single monetary figure can understate outcomes that are difficult to monetize.
A consequence rating reflects the situation after controls, so it already accounts for existing safeguards.
Whether an assessment reflects inherent effects (before controls) or residual effects (after controls) depends on the stated basis of the analysis. These can differ significantly, so the basis should be made explicit rather than assumed.

Best practices

State explicitly whether each consequence estimate reflects inherent or residual effects, and record the assumptions and data sources used as the basis of assessment.
Assess consequences across multiple categories relevant to your objectives, rather than defaulting to a single financial or operational dimension.
Use a defined severity scale calibrated to your organization's context, and document how descriptors map to concrete outcomes to promote consistent ratings.
Express consequences as a plausible range, considering a most-likely case alongside a reasonable worst case, to reflect the underlying uncertainty.
Keep consequence analysis distinct from likelihood analysis in your methodology, combining the two only where your risk assessment approach calls for it.
Consider how a single event may produce effects across several categories at once or cascade over time, so that aggregate impacts are not understated.
Promotional banner highlighting failures found in PCI audits and how to spot the gaps