vaayaa Inclusive Education
Creative risk assessment

Design Thinking and Creative Strategy Risk Assessment: Briefs, Privacy and Creative Delivery Risks

A worked example of how a design thinking and creative strategy team finds, scores and controls risks to briefs, private material, schedules, approvals, accessibility, ethics, licensing and production quality.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Design Thinking and Creative Strategy course

Executive summary

This assessment shows how a design thinking and creative strategy team can find, rate and control the risks that most affect its work. Eight risks were chosen because they are plausible in research, ideation, prototyping and delivery. Unclear briefs, privacy failures and approval errors are the most likely to disrupt projects, while ethical and licensing missteps are less frequent but can damage trust and reputation for years. Each risk is scored before controls and again after existing and added controls. Most fall to Medium or Low once controls are in place, but the privacy risk stays Medium because a breach of confidential material is serious even when rare. The first actions are a signed scope statement, a data handling rule for participant notes, a version-control convention and a licensing register. The example is for teaching only, so every score illustrates method rather than a real project.

Focus area
Design thinking and creative strategy
Setting
Creative studio or in-house design team running research, ideation, prototyping and campaign delivery for a client or organization
Method
Five by five likelihood and impact risk register

Scope

This assessment covers a design thinking project from first brief to delivered creative concepts, including research with users, workshops, prototypes, testing and handover of final assets. It looks at risks to confidential material, timelines, approvals, accessibility, cultural fit, licensed content and production quality. Jurisdiction, client sector and tools are not specified, so they are assumptions made for teaching.

Context

The team has a project lead, two designers, a researcher, a strategist and a producer who works with an external developer. Interviews, workshop notes and client data are held in shared folders and a project board. Concepts are prototyped, tested with a small group of users and refined before a final creative strategy is presented. Each risk is scored before controls to show its natural level, then again after existing controls and the additional controls proposed.

Objectives, assets and stakeholders

The objective is to produce creative strategy that is useful, ethical, accessible and delivered on time and within budget, while protecting the trust of users and clients. Assets in scope are research notes and recordings, client briefs and confidential data, prototypes and design files, licensed images, fonts and media, the project schedule and budget, and the reputation of the studio. Stakeholders include the design team, the client, research participants, end users, external developers, licensors and the creative director. Every risk has one owner role, and the project lead keeps the register current and reviews it with the client at each milestone.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H03 H04 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H02
3 Possible Likelihood 3, impact 3, score 9, medium: H05 Likelihood 3, impact 4, score 12, high: H07
2 Unlikely Likelihood 2, impact 4, score 8, medium: H08 Likelihood 2, impact 5, score 10, high: H06
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H03
2 Unlikely Likelihood 2, impact 2, score 4, low: H05 Likelihood 2, impact 3, score 6, medium: H01 H04 H06 H07 Likelihood 2, impact 4, score 8, medium: H02
1 Rare Likelihood 1, impact 3, score 3, low: H08
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Unclear brief and scope creep 16 High 6 Medium Project lead
H02 Privacy and confidential client data exposure 20 Critical 8 Medium Data steward
H03 Schedule and budget overrun 12 High 6 Medium Producer
H04 Approval and version-control failures 12 High 6 Medium Producer
H05 Usability and accessibility failures 9 Medium 4 Low Usability lead
H06 Ethical and cultural missteps 10 High 6 Medium Creative director
H07 Intellectual property and licensing breaches 12 High 6 Medium Design lead
H08 Technical compatibility and production defects 8 Medium 3 Low Producer
H01

Unclear brief and scope creep

Strategic Before 16 After 6

The brief is vague or changes after work starts, so concepts answer the wrong problem and effort grows beyond the agreed scope.

Who or what is affected: Design team, client sponsor and end users

Causes

Stakeholders with different goals, late requests and loose wording of the problem.

Consequences

Rework, missed deadlines, unpaid effort and concepts the client does not use.

Existing controls

  • A kick off workshop records the first brief.
  • Milestone reviews check progress with the client.

Control gaps

Requests are accepted verbally and never compared with the signed scope.

Additional controls

  • Prevent: Agree a signed brief with a change control route before research begins.
  • Detect: Log every request outside scope and show its cost to the client sponsor.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Project lead Target: Within 14 days Early warning: Scope change requests made after the brief is signed.
H02

Privacy and confidential client data exposure

Technology and data Before 20 After 8

Interview notes, recordings, personal details of participants and unreleased client plans are copied, shared or kept longer than needed, exposing people and the client.

Who or what is affected: Research participants, client and design team

Causes

Public links, personal devices, email attachments and unclear retention rules.

Consequences

Harm to participants, breach of agreement, loss of client trust and possible legal claims.

Existing controls

  • Participants sign a consent form before interviews.
  • Files sit in a shared folder with named access.

Control gaps

No one checks whether consent covers each use or who holds copies of recordings.

Additional controls

  • Prevent: Remove names from notes and keep recordings only for the agreed period.
  • Detect: Review folder access each month and flag links shared outside the team.
  • Respond: Withdraw access and inform the client within one working day of any suspected leak.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Data steward Target: Within 21 days Early warning: Participant files or client data stored outside approved folders.
H03

Schedule and budget overrun

Operational Before 12 After 6

Research, iteration and approvals take longer than planned, so the schedule slips and the budget is used before the final strategy is ready.

Who or what is affected: Project team, client finance and external developers

Causes

Optimistic estimates, unplanned testing rounds and waiting for client feedback.

Consequences

Late launch, unpaid overtime, cut scope and strained client relations.

Existing controls

  • A project plan lists milestones and hours.
  • Weekly status updates go to the project lead.

Control gaps

Hours are tracked weekly but not compared with the milestone estimate.

Additional controls

  • Prevent: Allow buffer time for testing and approval in every milestone estimate.
  • Recover: Re-plan scope with the client when a milestone runs over budget.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Producer Target: Within 30 days Early warning: Milestone hours near the budget limit before the milestone is complete.
H04

Approval and version-control failures

Operational Before 12 After 6

Files are renamed, duplicated or released without sign-off, so clients receive outdated or unapproved concepts.

Who or what is affected: Client approvers, design team and end users

Causes

Several versions in circulation, email approvals and unclear sign off roles.

Consequences

Wrong asset published, rework, client dispute and wasted spend.

Existing controls

  • Design files are saved in a shared project folder.
  • Final concepts are sent with a cover note.

Control gaps

Approval is given by email and never recorded against a file version.

Additional controls

  • Prevent: Use one naming convention and lock final files after approval.
  • Detect: Check each export against the approval log before release.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Producer Target: Within 14 days Early warning: Final assets exported without an approval record.
H05

Usability and accessibility failures

Operational Before 9 After 4

Concepts are tested with too few or unrepresentative users, or they fail accessibility needs such as contrast, text size or keyboard use, so people cannot use them.

Who or what is affected: End users, including people with disabilities, and the client

Causes

Small test groups, time pressure and accessibility treated as a final step.

Consequences

Exclusion of users, failed launch, rework and reputational harm.

Existing controls

  • Concepts are shown to users in a short review.
  • A checklist covers basic color contrast.

Control gaps

Test groups are not recorded, so gaps in who was tested go unseen.

Additional controls

  • Prevent: Test with a diverse group of users and include people with access needs.
  • Detect: Run an accessibility check at each milestone and record each failure.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Usability lead Target: Within 45 days Early warning: Prototypes failing an accessibility or usability check at a milestone.
H06

Ethical and cultural missteps

Reputational Before 10 After 6

Concepts stereotype, mislead or exploit a community, or use cultural symbols without respect, damaging trust in the strategy and the client.

Who or what is affected: Communities depicted, end users and the client

Causes

Limited cultural knowledge, pressure for bold ideas and few reviewers from the audience.

Consequences

Public backlash, lost client contracts and harm to people depicted.

Existing controls

  • Strategy reviews include a question on cultural fit.
  • Client brand guidelines set tone and imagery limits.

Control gaps

Review panels are drawn from the team alone, so blind spots are shared.

Additional controls

  • Prevent: Involve members of the audience in reviewing sensitive concepts early.
  • Respond: Pause the concept and revise it with the client when a concern is raised.
Likelihood 2 x impact 5 before; 2 x 3 after Owner: Creative director Target: Within 60 days Early warning: Feedback from users or reviewers that raises concern about stereotyping or misuse.
H07

Intellectual property and licensing breaches

Legal and compliance Before 12 After 6

Images, fonts, music or code are used in concepts without a valid license, or a client's own ideas are reused without agreement, creating claims of infringement.

Who or what is affected: Client, licensors and design team

Causes

Unclear license terms, assets copied from search results and mixed sources in shared folders.

Consequences

Claims for payment, takedown requests, withdrawal of work and loss of reputation.

Existing controls

  • Stock assets are downloaded from a managed account.
  • Contracts state who owns final creative work.

Control gaps

The register is not updated for assets added late in a project.

Additional controls

  • Prevent: Keep a licensing register that records source, license type and expiry for each asset.
  • Detect: Audit final assets against the register before each milestone sign off.
  • Respond: Remove any unlicensed asset and replace it with a cleared alternative.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Design lead Target: Within 30 days Early warning: Assets used without a matching license entry in the register.
H08

Technical compatibility and production defects

Operational Before 8 After 3

Prototypes or final files do not work across devices, browsers or handover tools, and production files lose quality, causing defects after launch.

Who or what is affected: Developers, end users and the production team

Causes

Unknown target devices, mismatched software versions and late changes to files.

Consequences

Broken experiences, extra development cost and delayed release.

Existing controls

  • Prototypes are opened on two common devices before review.
  • A handover checklist lists file formats.

Control gaps

Testing covers only a few devices and no one checks exported files against the handover list.

Additional controls

  • Prevent: Agree target devices and file formats with the developer at the brief stage.
  • Recover: Keep a defect log and fix the highest impact issues before the next release.
Likelihood 2 x impact 4 before; 1 x 3 after Owner: Producer Target: Within 60 days Early warning: Defect reports from testers on devices not covered by the test plan.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Severe. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score guides the order of work and is not a precise measurement. Inherent risk is the score before any controls. Residual risk is the score after existing and added controls, and it can never be higher than the inherent score. Impact is judged on harm to people, loss of confidential material, delay, extra cost, rework, legal exposure and damage to reputation. A risk is not rated down simply because it has not happened yet. Anything still High needs senior attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Team members and the client should challenge ratings at each milestone, and any rating is reviewed when its early warning indicator reaches the threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Scope change requests made after the brief is signed.Escalate to the project lead when a second change arrives, and to the client sponsor before any extra work starts.
Participant files or client data stored outside approved folders.Escalate to the data steward at once, and move the files within one working day.
Final assets exported without an approval record or with duplicate version names.Escalate to the producer when any asset lacks approval, and hold release until it is corrected.
Assets used without a matching license entry in the register.Escalate to the design lead at once and remove the asset until clearance is confirmed.
Prototypes failing an accessibility or usability check at a milestone.Escalate to the usability lead when a check fails twice, and to the creative director if the milestone date is at risk.

Contingency arrangements

If a serious event occurs, such as a leak of participant data or a licensed asset used without permission, the project lead pauses external sharing and preserves records. The producer informs the client and the creative director within one working day, and the IT lead restricts access to affected folders. Legal or licensing advice is sought through the client contact in line with the agreement. Affected assets are withdrawn and replaced with cleared alternatives, and the schedule is reset with the client in writing.

Prioritized action plan

  1. Agree a signed brief and scope statement with change control, owner project lead, within 14 days.
  2. Set a data handling rule for participant notes and client files, owner data steward, within 21 days.
  3. Adopt one version-control convention and a single approval log, owner producer, within 14 days.
  4. Start a license register for every image, font and media asset, owner design lead, within 30 days.
  5. Add an accessibility check and a user test to each milestone, owner usability lead, within 45 days.

Conclusion

Strong creative strategy depends on a few steady habits: a clear and signed brief, careful handling of participant and client data, one version of each file, licensed assets tracked from the start and testing with real users before launch. The highest scores sit with unclear scope, privacy and approval errors, and each has actions that reduce the residual score. Treat the register as a living record, review it at each milestone, and seek qualified advice for any legal, accessibility or licensing question that goes beyond this example.

Assumptions and limitations

Assumptions

  • The client shares some confidential brand and user information under a written agreement.
  • Jurisdiction and data protection duties are not specified, so legal points are described in general terms only.
  • The team uses common design and collaboration tools on managed devices.

Limitations

  • The scores are examples for learning and do not describe any real studio, client or product.
  • Licensing, privacy and accessibility rules vary and change, so specialist review is needed.
  • This is educational content and does not replace professional legal, accessibility or creative advice.

Related frameworks to study

  • Double diamond design process
  • Hierarchy of controls
  • Three lines model of risk ownership
  • Accessibility guidelines for digital content
  • Data minimization principles

Creative Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Design Thinking and Creative Strategy course Read the best practices for this course

More Creative risk assessments

Hourly Active: 45,552 Learners