vaayaa Inclusive Education
Professional risk assessment

Creative Design and Media Production Risk Assessment: Briefs, Rights, Quality and Approval Controls

A worked example of how a design and media team finds, scores and controls the risks that affect briefs, rights, usability, technical quality, privacy, schedule and approvals before work reaches an audience.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Creative Design and Media Production course

Executive summary

This assessment shows how a design and media team can find, rate and control the risks that most affect the quality, rights and trust in its work. Eight risks were chosen because they are plausible in everyday briefs, builds and approvals. Unclear briefs and approval confusion are the most likely, while rights breaches and privacy leaks are less frequent but cause the most harm. Each risk is scored before controls and again after existing and added controls. Most fall to Medium or Low once controls are in place, but privacy exposure stays at Medium because the impact remains serious. The first actions are a signed brief template, a rights log for every asset, a locked version repository and link controls for client files. The team is a teaching example, so every score illustrates method, not a real organization.

Focus area
Creative design and media production
Setting
Design studio and in-house media team producing client campaigns, websites, print and short video with freelance contributors
Method
Five by five likelihood and impact risk register

Scope

This assessment covers a design and media production team, from brief intake and concept work through build, testing, approval and delivery. It looks at risks to quality, rights, privacy, budget and reputation. Client sector, jurisdiction, tools and team size are not specified, so they are treated as assumptions made for teaching.

Context

The team has a creative lead, two designers, a motion artist, a developer and a producer who manages schedules. Work is drafted in shared design files and video editors, with reviews run through a shared review tool. Freelancers supply photography, music and illustration. Clients approve each stage in writing. Each risk is scored before controls to show its natural level, then again after existing controls and the controls that should be added.

Objectives, assets and stakeholders

The objective is to deliver accurate, accessible and lawful creative work on time and within budget, while protecting client confidence and the trust of the people who see or appear in the work. The assets in scope are design files, video and audio masters, licensed images and fonts, freelancer contracts, model releases, client data, the review tool and the team's reputation. Stakeholders include the design and production staff, freelancers, the client sponsor and approvers, print and hosting suppliers, end users and people pictured in the work. Every risk has one owner role, and the producer keeps the register current and reports to the client lead at each project milestone.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 2, score 8, medium: H07 Likelihood 4, impact 3, score 12, high: H03 H06 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H05
3 Possible Likelihood 3, impact 4, score 12, high: H02 Likelihood 3, impact 5, score 15, high: H04
2 Unlikely Likelihood 2, impact 5, score 10, high: H08
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H06
2 Unlikely Likelihood 2, impact 2, score 4, low: H03 H07 Likelihood 2, impact 3, score 6, medium: H01 H02 Likelihood 2, impact 4, score 8, medium: H04 H05
1 Rare Likelihood 1, impact 4, score 4, low: H08
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Unclear brief and scope creep 16 High 6 Medium Creative lead
H02 Usability and accessibility failures 12 High 6 Medium Lead designer
H03 Technical compatibility and production defects 12 High 4 Low Production lead
H04 Intellectual property and licensing breaches 15 High 8 Medium Producer
H05 Privacy and confidential asset leakage 20 Critical 8 Medium IT manager
H06 Schedule and budget overrun 12 High 6 Medium Producer
H07 Approval and version-control failures 8 Medium 4 Low Creative lead
H08 Ethical and cultural concerns in content 10 High 4 Low Creative lead
H01

Unclear brief and scope creep

Operational Before 16 After 6

Client goals, audience, deliverables and approval points are vague, so requests grow after work starts and effort is spent on an outcome the client did not really need.

Who or what is affected: Designers, producer and client sponsor

Causes

Clients who are unsure what they need, verbal briefs and pressure to agree to small extras without pricing them.

Consequences

Unpaid work, missed deadlines, team fatigue and disputed invoices.

Existing controls

  • Briefs are discussed in a kickoff call.
  • Change requests are noted in email threads.

Control gaps

Change requests arrive by message and are rarely recorded against the original brief.

Additional controls

  • Prevent: Use a signed brief template listing audience, deliverables, formats and the number of revision rounds.
  • Detect: Log every change request against the agreed scope and flag any item without a price or sign-off.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Creative lead Target: Within 30 days Early warning: Change requests that arrive without a written scope reference or a price decision.
H02

Usability and accessibility failures

Operational Before 12 After 6

Layouts, colors, navigation or video captions do not work for many users, including people using screen readers, keyboards or low vision, so the audience cannot complete basic tasks.

Who or what is affected: End users, client and people with disabilities

Causes

Visual-first design habits, late testing and no accessibility criteria written into the brief.

Consequences

Excluded users, complaints, rejected client acceptance and possible legal challenge.

Existing controls

  • Designers check color contrast in the design tool.
  • Final pages are viewed on desktop and phone before handover.

Control gaps

Testing is done by the designer who built the work, with no independent user check.

Additional controls

  • Prevent: Build accessibility checks into the design system, including contrast, focus order and alternative text.
  • Respond: Fix critical accessibility defects before launch and schedule an independent retest.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Lead designer Target: Within 60 days Early warning: Defects reported by a tester or user that relate to keyboard access, contrast or missing captions.
H03

Technical compatibility and production defects

Operational Before 12 After 4

Files, fonts, codecs, print settings or code behave differently across devices, browsers and print runs, so defects reach the client after sign-off and cost time to correct.

Who or what is affected: Client, end users and print suppliers

Causes

Mixed software versions, untested fonts and last minute asset changes made close to the deadline.

Consequences

Broken pages, misprinted material, rework cost and a delayed launch.

Existing controls

  • Files are exported to a standard set of formats before delivery.
  • The developer tests the main browsers before handover.

Control gaps

Testing covers only current browsers and does not include the client's actual devices or print proofs.

Additional controls

  • Prevent: Standardize fonts, color profiles, codecs and export presets in a project template.
  • Recover: Keep a tested rebuild route and a dated hotfix window for defects found after launch.
Likelihood 4 x impact 3 before; 2 x 2 after Owner: Production lead Target: Within 45 days Early warning: A print proof rejected by a supplier or a test device showing layout breaks.
H04

Intellectual property and licensing breaches

Legal and compliance Before 15 After 8

Images, fonts, music, templates or illustrations are used without a valid licence or credit, or freelance contributors keep rights the client assumed it owned.

Who or what is affected: Client, freelancers and rights holders

Causes

Assets taken from open search results, unclear freelancer terms and fast deadlines.

Consequences

Takedown demands, retrospective licence fees, claims and loss of client trust.

Existing controls

  • Stock assets are sourced from licensed libraries with purchase receipts.
  • Freelancers sign a contract that includes a rights transfer clause.

Control gaps

Licences are held by individuals and are not checked against the final intended use.

Additional controls

  • Prevent: Keep a rights log for every asset with licence type, scope, term and owner before use.
  • Detect: Check the final asset list against the rights log and the brief's usage terms before delivery.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Producer Target: Within 30 days Early warning: An asset in final files with no matching rights log entry.
H05

Privacy and confidential asset leakage

Technology and data Before 20 After 8

Unreleased designs, client data, test personas or photographs of identifiable people are shared with the wrong party, stored insecurely or used beyond the consent given.

Who or what is affected: Clients, people pictured and staff

Causes

Public share links, personal devices and real customer data copied into mock-ups.

Consequences

Breach of confidence, regulator attention, lost contracts and personal harm to people pictured.

Existing controls

  • Client folders are shared by named access only.
  • Staff sign a confidentiality clause in their contract.

Control gaps

No one checks link settings or model releases before publication.

Additional controls

  • Prevent: Use anonymized test data and collect written model releases before any identifiable person appears in work.
  • Respond: Revoke shared links within the hour, notify the client lead and record the incident for review.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: IT manager Target: Within 14 days Early warning: A shared link open to anyone, or a missing release for a person shown in final work.
H06

Schedule and budget overrun

Financial Before 12 After 6

Dependencies on client approvals, freelancers and rendering time slip, so the project overspends its budget or misses an agreed launch date.

Who or what is affected: Producer, client and freelancers

Causes

Optimistic estimates, late approvals and unplanned rework after feedback.

Consequences

Overspend, a missed launch, unpaid overtime and a strained client relationship.

Existing controls

  • A Gantt chart lists the main milestones.
  • Weekly status calls review progress against budget.

Control gaps

Hours are recorded but are not compared against the plan until the project is closed.

Additional controls

  • Prevent: Build review and rendering time into the plan and agree a fixed number of revision rounds.
  • Detect: Track hours per task each week and report any variance above ten percent to the client lead.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Producer Target: Within 30 days Early warning: Tasks running more than 20 percent over estimate with no approved change request.
H07

Approval and version-control failures

Operational Before 8 After 4

Files are edited in several copies, the wrong version is sent for sign-off, or approvals given by email do not match the final file that is published.

Who or what is affected: Client, team and printers

Causes

Local copies, many reviewers and approvals given in chat messages rather than the review tool.

Consequences

Wrong content published, rework and disputes over what the client actually approved.

Existing controls

  • Files carry a version number in the file name.
  • Clients approve each stage in writing by email.

Control gaps

Locks are not enforced, so people can still overwrite a file after it has been approved.

Additional controls

  • Prevent: Use one shared repository with locked approved versions and a single review tool for all comments.
  • Respond: Stop production when an unapproved version is found and reissue the approval request.
Likelihood 4 x impact 2 before; 2 x 2 after Owner: Creative lead Target: Within 30 days Early warning: An approved file whose checksum or date differs from the output being produced.
H08

Ethical and cultural concerns in content

Reputational Before 10 After 4

Imagery, language, stereotypes or cultural symbols are used in a way that offends or misleads an audience, or content makes claims the client cannot support with evidence.

Who or what is affected: Audience groups, client and team

Causes

Limited research on the audience and pressure to follow trending imagery without checking its meaning.

Consequences

Public complaint, withdrawal of work, reputational damage and lost trust with clients.

Existing controls

  • Briefs ask clients about sensitive subjects and approved sources.
  • A senior reviewer reads final copy before release.

Control gaps

Audience research is rarely done for smaller or repeat clients who are assumed to be familiar.

Additional controls

  • Prevent: Add a cultural and ethical check to the review checklist covering stereotypes, claims and sensitive symbols.
  • Detect: Test concepts with a small group from the intended audience before final production begins.
Likelihood 2 x impact 5 before; 1 x 4 after Owner: Creative lead Target: Within 60 days Early warning: Feedback from testers or public channels describing content as stereotyped, misleading or offensive.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Severe. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score guides the order of work and is not a precise measurement. Inherent risk is the score before any controls. Residual risk is the score after the existing and added controls. Impact is judged on money lost, time to correct, harm to a client or person pictured, and damage to reputation, and a rights or privacy risk is never rated down only because it has not yet happened. Anything still High needs senior attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Team members who do the work should challenge the ratings at each review, and any score is revisited when a monitoring indicator reaches its threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Change requests without a written scope reference or a price decision.Escalate to the producer at once, and to the client lead if the change is not priced within five working days.
Assets in final files with no matching rights log entry.Escalate to the producer before delivery and hold the file until each asset is cleared.
Accessibility or cross-browser defects still open at launch review.Escalate to the lead designer, and to the client if any critical defect remains open at sign-off.
Hours over estimate by more than 20 percent on any task.Escalate to the producer within a week, and to the client lead if the overrun exceeds the agreed budget.
Shared links set to public, or approved files that differ from the final output.Escalate to the IT manager immediately, and to the head of production if not closed within 24 hours.

Contingency arrangements

If a serious event occurs, such as a confirmed rights claim, a privacy leak or a launch with a critical defect, the producer pauses the affected work and preserves all versions and records. The IT manager revokes shared access and restores files from the latest tested backup. The client lead is informed promptly and in plain language. Legal and specialist advisers are contacted as the situation requires. Replacement assets are sourced under a licence, and the schedule is reset with the client in writing.

Prioritized action plan

  1. Adopt a signed brief template with a change request log, owner creative lead, within 30 days.
  2. Create a rights log and require licence proof for every asset, owner producer, within 30 days.
  3. Lock approved versions in one repository and retire local copies, owner production lead, within 30 days.
  4. Set link controls and anonymized test data rules for all client work, owner IT manager, within 14 days.
  5. Add accessibility and cultural checks to the release review, owner lead designer, within 60 days.

Conclusion

Reliable creative work depends on a few steady habits: signed briefs, a rights log for every asset, locked approved versions, anonymized test data and a tested build process. The highest scores sit with unclear scope, rights and privacy, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified legal or accessibility advice for any real question about rights, privacy or compliance.

Assumptions and limitations

Assumptions

  • The team works for external clients on paid projects and publishes to web, print and social channels.
  • Jurisdiction is not specified, so rights and privacy duties are described in general terms only.
  • Staff use commercial design and editing software on managed devices with shared cloud storage.

Limitations

  • The scores are examples for learning and do not describe any real studio, client or project.
  • Copyright, licensing, privacy and accessibility rules differ by country and change over time, so specialist legal review is needed.
  • This is educational content and is not legal, accessibility or professional advice.

Related frameworks to study

  • Web Content Accessibility Guidelines for usability and accessibility testing
  • Hierarchy of controls for ranking mitigations
  • Three lines model for risk ownership

Professional Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Creative Design and Media Production course Read the best practices for this course

More Professional risk assessments

Hourly Active: 39,499 Learners