Risk Identification, Measurement and Assessment
Core Concepts
Risk identification aims to find all material risks before they crystallize. Candidates should know techniques such as brainstorming, Delphi, scenario analysis, SWOT, process mapping, and loss-event databases. Measurement converts identified risks into quantitative or qualitative assessments. Key tools include risk registers (likelihood, impact, owner, controls), heat maps, and risk matrices. Quantitative methods include expected loss (probability × impact), value at risk (VaR), stress testing, and scenario analysis. Qualitative methods include risk scoring and expert judgment. Inherent risk is before controls; residual risk is after controls. Risk assessment also considers velocity (speed of onset) and persistence.
Traps in Questions
- Confusing inherent and residual risk.
- Treating identification as a one-time exercise; it should be continuous.
- Overlooking interconnected risks (e.g., a supplier failure cascading into operational and reputational risk).
- Assuming high-frequency/low-severity risks need the same treatment as low-frequency/high-severity ones.
Worked Example
A firm identifies a cyber breach risk with likelihood 10% per year and impact $5 million. Inherent expected loss = 0.10 × $5m = $500,000. After implementing a $200,000 control that reduces likelihood to 4%, residual expected loss = 0.04 × $5m = $200,000. The control is cost-justified because it saves $300,000 in expected loss for $200,000 cost.
Rule of thumb: Identify broadly, assess consistently, and always compare residual risk to tolerance.