Once the quality of evidence has been assessed, the completed information table is then used to assess the risk posed by the threat using the risk assessment algorithms. Two approaches are presented, the first option combines probability and impact into a single algorithm resulting in a single overall risk level, whilst the second assesses probability and impact separately. Both approaches make use of all the available information collected in the respective table to assess the level of risk, and also aid the identification of gaps in knowledge. It may be difficult to rapidly assess a potential threat where some of the information necessary to inform the risk process is not known, and this uncertainty is documented and managed in the algorithms by adopting a precautionary approach and moving through the algorithm to a higher level of risk.

The combined approach has the advantage of greater simplicity. However, the use of separate algorithms to assess probability and impact avoids over-simplification and provides a more accurate assessment in situations where there is a high probability low impact disease or a low probability high impact disease, whilst the resulting individual risk levels can be combined into a single overall risk level using the risk ranking matrix. Preferences of those doing the rapid risk assessment and the circumstances of the incident will determine which option is used. 

The chosen approach should be applied to the general population and then repeated for those groups at increased risk of infection, in whom the risk may be very different. It should be noted that the rapid risk assessment may change over time in light of new information or events and should be updated accordingly.