Information Risk Management
Risk management is the systematic identification, analysis, evaluation and treatment of risks to information assets. A risk is the combination of a threat exploiting a vulnerability, with likelihood and impact determining the level. Candidates must distinguish a threat (a potential cause of harm, such as a hacker or flood), a vulnerability (a weakness that can be exploited), an exposure (the potential loss) and a control (a safeguard). Risk assessment can be qualitative (descriptive scales such as high, medium, low) or quantitative (monetary values such as annualised loss expectancy). Key quantitative terms are single loss expectancy (SLE), annualised rate of occurrence (ARO) and annualised loss expectancy (ALE = SLE x ARO).
Risk treatment options
There are four standard responses: mitigate or reduce (apply controls), transfer (insurance or outsourcing), avoid (stop the activity) and accept (retain within risk appetite). Risk appetite and risk tolerance describe how much risk an organisation is willing to take. Residual risk is what remains after controls are applied, and it must be accepted by an accountable owner. Risk registers record risks, owners, ratings and treatment plans.
Traps and worked example
Examiners often swap threat and vulnerability, or ask you to calculate ALE. Example: an asset worth 100,000 has a 20 percent chance of loss per year (SLE = 20,000) and occurs twice a year, so ALE = 40,000. If a control costs 10,000 annually and halves the ARO, the saving is 20,000, so the control is justified. Rule of thumb: controls must be proportionate and cost-effective, and residual risk always needs explicit acceptance.