Risk Identification and Risk Assessment
Identification techniques
Risk identification is systematic, not intuitive. Candidates should know brainstorming and workshops, interviews, process mapping, scenario analysis, checklists, incident data review, and bow-tie analysis. A risk register records the risk description, cause, event, consequence, owner, existing controls, likelihood, impact, and rating. A frequent exam trap is a register entry that describes a control or a consequence rather than the risk event itself; a well-formed entry follows cause-event-consequence logic.
Assessment approaches
Qualitative assessment uses scales and matrices; semi-quantitative assessment assigns numeric bands to scales; quantitative assessment uses data and models. Likelihood-impact matrices are simple but suffer from range compression and inconsistent scale definitions. Inherent versus residual assessment must be clearly labelled, and controls must be evidenced rather than assumed.
Emerging and change risk
Horizon scanning, key risk indicators, and emerging-risk committees address risks not yet in historical data. Change risk arises from new products, systems, outsourcing, or regulation, and should trigger a fresh assessment rather than reuse of an old rating.
Worked example
A payments team identifies "third-party processor outage." The cause is single-provider dependency; the event is a processing outage; the consequence is failed customer payments and regulatory breach. Inherent likelihood is high, inherent impact is high. After adding a tested failover provider, residual likelihood drops to medium while impact stays high because customer harm is unchanged. The register must show both ratings and the control evidence.