Risk Identification and Assessment
Finding risk
Risk identification draws on process mapping, workshops, interviews, loss-event data, regulatory changes, and external threat intelligence. Candidates should recognize that identification is continuous, not a once-a-year exercise. Techniques include brainstorming, Delphi, scenario analysis, and bow-tie analysis that links causes, events, controls, and consequences. A common trap: confusing a risk with a control weakness or an issue. A risk is a potential future event; an issue is something that has already happened or is certain to happen.
Assessing risk
Assessment combines likelihood and impact, often through a risk matrix or a scoring model. Know the difference between qualitative (descriptive scales) and quantitative (monetary, probabilistic) assessment. Inherent and residual scoring must both be captured. Risk aggregation matters: individually acceptable risks can combine into an unacceptable portfolio exposure, and correlation can amplify impact.
Risk taxonomy and registers
A register should record the risk statement, owner, cause, consequence, existing controls, inherent and residual ratings, and treatment plan. Well-formed risk statements use a cause-event-consequence structure. Weak statements like "cyber risk is high" fail because they lack a specific event and consequence.
Worked example
A team rates a data-breach risk as high likelihood and high impact. They add encryption and access reviews, then re-rate it medium. The inherent rating stays high; only the residual moves. A question that asks for "the risk rating after controls" wants residual, and a question asking what the controls changed wants the residual score, not the inherent one. Rule of thumb: always ask whether the question is describing the world before or after controls.