Risk Management Process

What risk actually is

“Risk” gets used loosely. In risk management it has a precise shape: something valuable (an asset), something that could harm it (a threat), and a weakness that would let the harm happen (a vulnerability).

A threat with no vulnerability to use, or a vulnerability no threat can reach, poses little risk. Controls work by reducing the likelihood (closing gaps, blocking threats) or reducing the impact (backups, insurance).

• Inherent risk is the level before any controls.
• Residual risk is what’s left after controls.

The cycle

When the exam asks what comes first in a risk assessment, the answer is usually identifying the assets (and their value or criticality). You can’t prioritise threats to things you haven’t listed.

Who does what

• The board sets risk appetite.
• Risk owners in the business are accountable for their risks. They decide on treatment and accept the residual risk.
• The risk function provides the framework and methods, facilitates assessments, and pulls the picture together.
• Control owners run the controls.
• Internal audit gives independent assurance that risk management works. It doesn’t own or run it.

This is often called the three lines model: management (first line), risk and compliance (second line), internal audit (third line).

The risk register

A risk register records each risk with its owner, ratings, controls, treatment plan and status:

Keep it current

Risks change with new systems, threats, suppliers and laws. Assessments should be repeated regularly and after significant change. Key risk indicators give early warning in between.

Example. A company assessed IT risk in January. In June it moved customer data to a cloud service. Without a new assessment, the risk register still talks about on-premises databases and says nothing about the provider, its access model or where the data now lives.

How the exam asks about it

In short

• Risk management starts with context and assets, then threats and vulnerabilities, then analysing likelihood and impact.
• Risk exists when a threat can exploit a vulnerability to harm an asset.
• Risk evaluation compares each risk with the organisation's appetite to decide what to do.
• Treatment options are mitigate, transfer, avoid or accept; residual risk must be within appetite and accepted by the risk owner.
• Risk management is continuous: risks are monitored and reassessed, especially after changes.
• Business risk owners are accountable for their risks; the risk function facilitates; internal audit gives independent assurance.
• A risk register records each risk, its owner, rating, treatment and status.

Exam traps

• The first step in a risk assessment is identifying and valuing assets, not picking controls.
• A vulnerability no threat can exploit (or a threat with nothing to exploit) doesn't create much risk.
• IT doesn't own business risks. The business owner accepts residual risk.
• An annual risk assessment isn't enough after a big change; reassess when things change.
• Audit evaluates the risk management process; it doesn't run it.

Slides

Click the slide and use the arrow keys. F toggles full screen.