Risk Analysis and Assessment Methodologies
Domain 3 tests selecting and applying analysis methods, not just reciting formulas. You need to know when qualitative, semi-quantitative, and quantitative methods fit.
Core rules
- Qualitative methods use ordinal scales such as low, medium, and high; they are fast but weak for aggregation and cost-benefit.
- Quantitative methods express loss in monetary terms; FAIR, Monte Carlo simulation, and decision trees support capital decisions.
- Classic formulas: SLE = asset value × exposure factor; ALE = SLE × annualized rate of occurrence; control benefit = ALE before minus ALE after.
- Analysis must state assumptions, data sources, time horizon, and confidence; sensitivity analysis shows which variable drives the result.
- Semi-quantitative scoring can rank risks but should not be averaged as if the numbers were cardinal.
Worked example
A payment system is valued at $4 million. A DDoS scenario would expose 25% of value, so SLE = $1 million. The team estimates two events per year, so ALE = $2 million. A mitigation service costs $300,000 per year and reduces event frequency to 0.5 per year. New ALE = $500,000; avoided loss = $1.5 million; net benefit = $1.2 million. The reasoning compares annualized loss with annual control cost, then documents that the frequency estimate is the most sensitive assumption.
Traps
- Averaging ordinal ratings, for example treating high plus medium as 3.5.
- Presenting a point estimate without a range or confidence level.
- Mixing inherent and residual inputs in one calculation.
- Using false precision from sparse incident data.