Risk Identification and Exposure Analysis
Identification and exposure analysis
Risk identification asks what could happen, why, and where exposure exists. Candidates should know a portfolio of methods: brainstorming, structured interviews, process mapping, checklists, scenario analysis, root-cause analysis, loss-event data, SWOT, Delphi, and lessons learned. No single method is complete; triangulation improves coverage. Exposure analysis then estimates frequency and severity, ideally as distributions rather than single points. Expected loss equals frequency times average severity; unexpected loss reflects volatility and drives capital. Distinguish inherent exposure (before controls) from residual exposure (after controls), and identify dependencies and correlations because risks rarely occur alone.
Question traps include treating the risk register as a complete inventory, confusing inherent and residual ratings, and using one expert's estimate as fact. Availability bias and anchoring distort workshops; facilitate anonymously and challenge consensus. Correlations matter: two “low” risks that fail together can create a high combined exposure. Also watch for confusion between likelihood and frequency, and between impact and severity; they are related but not identical.
Worked example: a payment process has historically averaged three fraud losses per year, each about $20,000. Expected annual loss is 3 × $20,000 = $60,000. If a control reduces frequency to one event per year, residual expected loss is $20,000, but the control's cost and failure mode must be included. If losses are volatile - one year zero, next year $150,000 - the expected loss alone understates capital needs; use a distribution or scenario range.
Rule of thumb: identify broadly, quantify with ranges, and compare inherent with residual. Record the method and data source for every estimate so the analysis is auditable.