Risk assessment is a well-established approach to managing risk. However, the usefulness of a risk assessment is severely limited unless risks are adequately identified and outcomes of the process are effectively implemented. This bulletin describes three events in which risk identification was found to be inadequate, or risks had been identified but control measures were not effectively implemented. The focus of this issue will be on tools and methods that can be adopted to support the risk identification and the implementation of risk controls.