160 Risk Assessment a trigger event. In other words, an organization can be exposed to a number of compliance risks but it may be difficult to identify the particular compliance issue that will become a problem. Table 14.4 illustrates the balance of operational, project and strategic issues for each of the four headings of the FIRM risk scorecard. It can be seen that hazard risks are closely related to infrastructure issues and strategic risks are more likely to arise in relation to issues concerned with the marketplace. The risk classification systems discussed in this chapter are most easily applied to the analysis of hazard risks, except that the IRM Standard and the COSO frame- work offer strategic risk as a separate risk category. It will be for an organization to decide whether a category of strategic risks is helpful and necessary. The FIRM risk scorecard offers a means of classifying strategic and project risks according to the main impact associated with the risk, should it materialize. As with other core processes in an organization, classification of risks facing projects is essential, so that the appropriate response to each risk can be identified. Given that the requirements of any project are that it should be delivered on time, within budget and to specification, these components offer a means of classifying project risks. Separate lists could be devised of risks that threaten the timescale, risks that threaten the budget and risks that will affect the final specification, performance or quality of the project outcome.