Risk Identification, Assessment, and Treatment
This domain tests the mechanics - not the vocabulary - of risk management: turning uncertainty into scored, owned, treated, and monitored entries, and defending how a residual score was derived.
The ISO 31000 flow
Scope and context, then identification, analysis, evaluation, and treatment, with monitoring and review plus recording and reporting running throughout.
Scoring discipline
- Calibrate scales with concrete examples so a "4" means the same thing to every assessor.
- Inherent is before controls; residual is with controls operating as designed; target is after planned treatment.
- Score residual only after assessing control design and evidence of operation.
- The risk owner is accountable and can accept the risk; the control owner runs the control. They are often different people.
Treatment options
Avoid, reduce (likelihood or impact), transfer or share (insurance, contract), and accept with documented authority. ISO 31000 also recognises pursuing or increasing risk to capture opportunity.
Register fields
ID, cause-event-consequence description, category, owner, inherent score, controls, control effectiveness, residual, target, treatment plan, due date, KRI, status.
Worked example
Ransomware against the customer database. Inherent: likelihood 5 (sector-targeted, unpatched VPN) × impact 4 (notification costs, downtime) = 20, high. Controls: MFA, EDR, tested offline backups. Design evidence shows MFA enforced for all VPN users, EDR coverage 96%, backups restored twice in the year - so likelihood falls to 3 and impact to 3, residual 9, moderate. Planned treatment (quarterly restore tests, EDR to 100%) targets 2 × 3 = 6. Because 9 exceeds the acceptance threshold of 8, the risk owner must approve acceptance in writing and report quarterly.
Traps that cost marks
- Computing residual before validating control effectiveness.
- Double counting the same control against both likelihood and impact.
- Treating insurance as elimination - deductibles, business interruption, and reputational harm remain.
- Letting a workshop facilitator or the risk function "own" risks that belong to business managers.