This will be covered in more detail elsewhere but some of the remember that risks can be assessed at differing levels:
How a risk is assessed (e.g. high, medium or low) may indicate who will need to be consulted in terms of any decision making.
Remember, HIGH risk does not necessarily equate with HIGH impact upon the project. Conversely, a LOW risk activity may be extremely unlikely to happen but if it does it could be devastating for the project and hence have a HIGH impact.
The range of risk impact will reflect the way resource is allocated. What is considered a fairly trivial risk (low impact) will be handled by the project team.
A major risk may need a more formal approach in assessing the impact requiring mathematical techniques. This will employ a more formal basis.
At some point resource will need to be allocated to minimise the risk. A contingency plan will be instigated when the trigger is activated. The trick is trying to balance the resource allocated so that the project uses the minimum required.