Chapter 14 — Risk assessment
Lesson map
Lesson 14 published. Map, example, EX040.
flowchart TD
N0["Learning outcomes"]
N1["14.1 Risk components"]
N2["14.2 Estimating"]
N3["14.3 The register"]
N4["14.4 Treating risks"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX040"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["14.1 Risk components"]
N2["14.2 Estimating"]
N3["14.3 The register"]
N4["14.4 Treating risks"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX040"]
[Learning outcomes]
|
v
[14.1 Risk components]
|
v
[14.2 Estimating]
|
v
[14.3 The register]
|
v
[14.4 Treating risks]
|
v
[Worked example] --> [Exercise EX040]
Learning outcomes
You will (1) identify threats and vulnerabilities; (2) estimate likelihood and impact; (3) produce a prioritised risk register.
14.1 Risk components
Aisha learns that risk combines the likelihood of a harmful event with its impact. NIST SP 800-30 Revision 1 describes risk assessment as identifying threat sources and events, vulnerabilities, likelihood and impact. She identifies threats to Ashfield, such as criminals sending fake payment requests, and vulnerabilities, such as staff unable to verify requests easily. Dr. Carrow explains that risk exists only when a threat can exploit a vulnerability to cause harm to something valued. She writes one example threat and vulnerability for each of Ashfield's main systems.
14.2 Estimating
Aisha uses a simple scale of low, medium and high for likelihood and impact. Fake payment requests are likely, because fraudsters target small financial organisations, and impact is high, because money could be lost. A fire at the head office is unlikely but high impact. She records her reasoning for each rating so others can challenge it. She learns that ratings are judgements, and that writing down the reasoning makes them reviewable. Her seminar group challenges two ratings, and she changes one after hearing their reasoning.
14.3 The register
Aisha builds a risk register for Ashfield with ten entries, each with description, owner, likelihood, impact, current controls and planned actions. She sorts it by combined rating. Fake payment requests, ransomware and staff misuse of member data rank highest. The IT manager and chief executive review the register and agree owners. Dr. Carrow notes that a register is useful only if owners act and it is updated when circumstances change. The register is stored in a shared folder, and the IT manager adds a review of it to each quarterly board report.
14.4 Treating risks
For each risk, Ashfield chooses a treatment: reduce it with controls, transfer it through insurance or contracts, avoid it by stopping an activity or accept it within appetite. Aisha recommends reducing fake payment risk by requiring call-back verification to known numbers. She notes that cyber insurance transfers some financial loss but not reputational harm. She learns that treatment choices should be recorded with reasons and approved by the risk owner. The chief executive approves the call-back rule, and finance staff receive a printed list of verified supplier phone numbers.
Worked example
Aisha identifies threats and vulnerabilities, rates likelihood and impact with reasons, builds a ten-entry register and chooses treatments including call-back verification.
Synthetic case. The register is synthetic.
Errors and limits
Insurance transfers some financial loss but not reputational harm.
Exercises
- EX040 — Assessment source. Which publication guides the risk assessment? Rubric: 3 = NIST SP 800-30 Revision 1;; 2 = partly correct;; 1 = other;; 0 = none.
- EX041 — Top risks. Name one of the top three risks. Rubric: 3 = fake payment requests;; 2 = one;; 1 = vague;; 0 = none.
- EX042 — Payment treatment. How is fake payment risk reduced? Rubric: 3 = call-back verification to known numbers;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 14 (chapter 14 of 40)
← Chapter 13 · Course chapter index · Chapter 15 →
Continue to the next authored lesson.