Risk Identification and Assessment
Risk Identification and Assessment
This domain examines how risks are found, described and scored before controls are chosen. The exam favours practical questions on risk registers, likelihood and impact matrices, inherent versus residual risk, and the difference between a cause, an event and a consequence.
Core concepts
- Identification methods include process mapping, workshops, interviews, checklists, PESTLE and SWOT, incident and near-miss data, and walkthroughs. Use more than one source; a workshop alone misses system and third-party risks.
- Define risk criteria before scoring. A common five-point scale multiplies likelihood by impact; document what each score means.
- Inherent risk is assessed before controls; residual risk after controls. Target risk is the level the organisation wants.
- Root-cause analysis asks why a control failed, not just what happened.
Worked example
In a supplier-payment process, staff identify 'duplicate payment' as an event. Cause: vendor master data can be changed without independent approval. Consequence: overpayment and recovery cost. The workshop scores inherent likelihood 5 and impact 4, giving 20 (high). Existing controls - three-way match and monthly vendor statement reconciliation - reduce residual likelihood to 2 and impact to 3, giving 6 (medium). The risk owner accepts the residual score but adds a quarterly duplicate-payment analytics test because the risk is above the low threshold. Reasoning: the score must follow a defined scale, and the control description must explain the movement from inherent to residual.
Traps
- Recording a risk as a control failure or as a single incident.
- Using a heat map without documented scoring definitions.
- Scoring residual risk before identifying controls.
- Ignoring change - new systems, outsourcing or regulations - that creates new risks.