Risk Assessment and Security Audit
What to know cold
Risk is the combination of likelihood and impact against an asset and threat. Know the difference between qualitative (scales, Delphi) and quantitative (ALE = SLE × ARO; SLE = asset value × exposure factor) methods, and when each is appropriate. Understand threat, vulnerability, likelihood, impact, inherent risk, and residual risk, and where controls sit (preventive, detective, corrective). Be able to describe the audit lifecycle: scoping, evidence gathering, sampling, testing, findings, and management response. Know that an audit tests against a criterion; a risk assessment estimates exposure; a penetration test exploits.
Traps that show up in questions
- Mixing up SLE and ALE, or forgetting that ARO is annualised frequency.
- Treating a vulnerability as a risk - a vulnerability only becomes risk when a threat can exploit it against an asset.
- Assuming a control removes risk; most reduce it, and residual risk must be accepted.
- Confusing an audit (independent, criteria-based) with a self-assessment.
- Forgetting that sampling introduces detection risk.
Rule of thumb
Write the chain: asset → threat → vulnerability → likelihood → impact → control → residual risk → owner acceptance. Any answer that skips a link is suspect.
Worked example
An asset is worth 200,000. A fire would destroy 40%, so SLE = 80,000. Expected once every four years, so ARO = 0.25 and ALE = 20,000. A suppression system costing 6,000 per year reduces exposure; if it cuts ALE to 5,000, the control saves 15,000 annually against a 6,000 cost - justified on economic grounds, subject to non-financial factors.