Risk Assessment and Hazard Analysis
Risk is a product, not a list
A defensible risk assessment identifies threats and hazards, estimates likelihood and consequence, and evaluates vulnerability and exposure to produce a risk estimate. Many programs use a threat-and-hazard identification and risk assessment, or a capability-based assessment that compares needed capabilities against current ones to expose gaps. A simple expression is risk = likelihood x vulnerability x consequence; a 5x5 matrix multiplying likelihood by consequence is the common qualitative tool.
Do not confuse risk assessment with BIA
A business impact analysis asks what happens to functions over time and sets recovery priorities, recovery time objectives, and maximum tolerable downtime. A risk assessment asks what could happen and how bad it could be. Exam items frequently swap the two.
Treatment and residual risk
Treatment options are avoid, reduce, transfer, and accept. After treatment, some residual risk remains and must be documented and accepted by an accountable authority. Risk appetite (willingness to accept) and risk tolerance (acceptable variation) are different ideas. Look for cascading and concurrent hazards, single points of failure, and dependencies on utilities, suppliers, and telecommunications.
Traps
Ranking hazards by frequency alone, ignoring consequence; treating a hazard map as a complete assessment; assuming quantitative precision from thin data; ignoring social vulnerability and access-and-functional-needs populations.
Worked example: A river flood scores likelihood 4 and consequence 5 on a 5x5 matrix, giving 20 (high). Installing flood barriers reduces consequence to 3, giving 12 (medium). The remaining score of 12 is residual risk; the program documents it and names the official who accepts it.