Risk Management
What the domain really tests
Risk management is the discipline of identifying, analyzing, treating, and monitoring risk to within the organization's appetite. Know the vocabulary precisely: asset, threat, vulnerability, likelihood, impact, inherent risk (before controls), residual risk (after controls), risk appetite (how much risk leadership wants to pursue) versus risk tolerance (acceptable deviation). Know the treatment options - mitigate, transfer, avoid, accept - and that acceptance must be an informed decision by the accountable business owner, documented with a date and review cycle.
Quantitative analysis uses single loss expectancy (SLE = asset value × exposure factor), annualized loss expectancy (ALE = SLE × annualized rate of occurrence), and cost-benefit comparison of ALE reduction against control cost. Qualitative methods use ordinal scales and are faster but not additive. Also understand the risk register, risk assessment methodologies, business impact analysis as an input to risk prioritization, and third-party/supply-chain risk.
Traps
- Describing insurance as eliminating risk - transfer moves financial consequence, not the event.
- Treating risk as something to be reduced to zero; the goal is to manage within appetite at acceptable cost.
- Adding ordinal qualitative scores as if they were cardinal numbers.
- Forgetting that residual risk persists after treatment and must itself be accepted and monitored.
- Assuming security owns and accepts risk - acceptance belongs to the business owner.
Rule of thumb
If annual control cost exceeds the ALE reduction it delivers, the control is not justified on risk grounds alone - look for regulatory or contractual drivers before approving it.
Worked example: A server room asset is valued at $2,000,000; a flood would destroy 30% (SLE = $600,000). Flooding occurs once in 10 years (ARO = 0.1), so ALE = $60,000. A barrier costing $25,000 per year reduces ARO to 0.02, cutting ALE to $12,000 - a $48,000 annual benefit against $25,000 cost. Justified, with $12,000 residual risk still requiring acceptance.