Risk identification and risk analysis
Domain 5 - Risk identification and risk analysis
This domain tests whether you can find realistic risk scenarios and analyse them consistently. Identification is not an asset list; analysis is not a score without reasoning.
Core rules
- Identify assets and processes, risk sources, threats (adversarial, accidental, environmental), vulnerabilities, existing controls, events and consequences.
- Use more than one technique: brainstorming, interviews, checklists, scenario analysis, bow-tie, fault-tree, FMEA or Delphi. The standard does not mandate a single technique.
- Analyse consequence and likelihood, considering existing controls, uncertainty, dependencies and cascading effects.
- Qualitative, semi-quantitative and quantitative methods are all acceptable if criteria are defined and results are comparable.
- Separate inherent risk (before planned treatment) from current or residual risk (with existing controls) and state which is being reported.
Worked example
A phishing scenario targets finance staff. Consequence: fraudulent payment and data loss; likelihood: high because of prior near-misses and weak reporting culture. Existing controls: email filtering and annual awareness. Analysis rates current likelihood as medium, consequence as high, giving high risk. The team records the reasoning and the uncertainty: detection is slow. Reasoning: the scenario links threat, vulnerability and consequence; the score is supported by evidence, not intuition alone.
Traps
Calling a vulnerability a risk; ignoring accidental and environmental threats; double-counting controls; mixing inherent and residual scores; false precision from quantitative tools with poor data; ignoring third-party and cascading dependencies.