Risk Management
The risk process
Risk management is a continuous cycle: identify assets and threats, assess vulnerabilities, analyze likelihood and impact, evaluate against risk appetite, treat, and monitor. Know the treatment options: mitigate (apply controls), transfer (insurance, contracts), avoid (stop the activity), and accept (documented decision). Residual risk remains after controls; inherent risk exists before them. Qualitative scales (high/medium/low) suit broad screening; quantitative methods (annualized loss expectancy) suit financial justification.
Key formulas and concepts
SLE = asset value × exposure factor. ALE = SLE × annualized rate of occurrence. Use these to compare control cost against expected loss reduction. Understand that a control is justified when its cost is less than the ALE it removes, and remember that risk registers, heat maps, and key risk indicators provide ongoing visibility rather than one-time snapshots.
Traps to expect
- Confusing a threat (who or what can cause harm) with a vulnerability (a weakness) and a risk (the combination with likelihood and impact).
- Treating risk assessment as a one-time project rather than recurring.
- Selecting "eliminate all risk" as an answer; zero risk is neither achievable nor affordable.
- Forgetting that acceptance must be authorized at the right level.
Rule of thumb
Match the rigor of the assessment to the criticality of the asset, and always tie treatment decisions back to documented risk appetite.
Worked example: An asset worth $500,000 with a 40% exposure factor has an SLE of $200,000. If the threat occurs twice a year, ALE is $400,000. A $100,000 control that halves occurrence is justified because it removes about $200,000 in expected annual loss.