Risk Assessment
Identify, analyze, evaluate
IT risk assessment has three phases. Identification builds the inventory: assets, processes, data flows, threats, vulnerabilities, and existing controls, often through risk scenarios ("who or what could exploit which vulnerability, and with what consequence?"). Analysis assigns likelihood and impact, qualitatively (scales, heat maps) or quantitatively (monetary loss, annualized loss expectancy). Evaluation compares the result against risk criteria so risks can be ranked, compared, and prioritized for response. The output is the risk register, recording the risk statement, owner, inherent and residual scores, controls, and treatment status.
Know the quantitative vocabulary: single loss expectancy equals asset value times exposure factor; annualized loss expectancy equals single loss expectancy times annualized rate of occurrence. Know that risk arises from threat, vulnerability, and impact together; a severe threat against a well-controlled asset may be low risk. Business impact analysis supplies impact data, and key risk indicators provide early warning between formal assessments.
Traps
Questions deliberately conflate inherent risk (before controls) with residual risk (after controls). Scoring a risk without saying which one is being asked for is the most common error. Another trap implies assessment is a one-time project: it must be repeated on a schedule and triggered by change. Do not assume quantitative is always superior; qualitative is appropriate when data is unavailable or the decision is comparative. A heat map is only as good as its defined scales, and subjectivity must be managed through calibration.
Rule of thumb
If a control is in place and the question does not explicitly say "inherent," score the residual risk and note the control set behind it.
Worked example. A server worth $200,000 has a 40% exposure factor against a specific failure, so single loss expectancy is $80,000. The event is expected twice a year, so annualized loss expectancy is $160,000: the figure used to justify spending on a control.