In this lesson,
we will learn about risk assessment.
Risk assessment identifies, analyzes,
and evaluates the potential impact of risks
and guides the implementation of mitigation strategies.
Risk assessment concepts include quantitative analysis,
qualitative analysis, risk prioritization, risk appetite,
and risk tolerance.
In order to fully understand each of these concepts,
we first need to understand the risk management lifecycle.
The risk management lifecycle is how we deal
with risk every day in the real world.
Steps in the risk management lifecycle include,
identification, assessment, control,
and the review of risks.
So what exactly is risk management
and why is it adopted by organizations?
Well, quite simply put, risk management helps us see all
of the different risks that are out there,
and then put controls in place to help bring down the level
of risks to an acceptable level.
As an organization, we adopt risk management to ensure
that our confidential data stays, well, confidential,
and we want to make sure that all of our customer data
and all of our corporate data doesn't get into the hands
of unauthorized parties.
We do this by identifying total risk
and then putting risk mitigations in place.
But mitigating risk is not the only choice we have.
We might choose to do nothing with the risk at all.
Maybe it's just too expensive to do so,
but we can't stop doing that risk of behavior,
it's just too critical to our business.
This is called risk acceptance.
It's important to remember
that risk acceptance is not risk ignorance, in other words,
just because we accept the risk doesn't mean
that we are never going to think about it again, we will.
Actually, we will continue to monitor the risk
after we have accepted it to see if the risk increases
to the point that it is no longer acceptable.
On the other hand, we might decide
that the risk is just too much to work with.
In this case, we might avoid that risk altogether.
Risk avoidance is identifying risk,
deciding it is just too much,
and then stopping whatever that risky activity is.
For example, maybe I decide that driving
to work is just too risky of an activity for me.
I still need to work, I just can't drive there.
So I avoid the driving risk by not driving
and looking for alternatives such as remote work
or working near home where I can walk to
and from the office,
or I might decide that there are some mitigations
that I can put in place to reduce the risk of driving
to an acceptable level.
These might include, getting training
and my driver's license,
being well rested and wearing a seatbelt.
With these risk mitigations in place, I can feel comfortable
with the risk of driving to work.
However, I know that even
after I take all the precautions I can,
there is still some risk in driving,
this is residual risk.
After identifying risk, analyzing helps us decide exactly
how we are going to handle it.
Analyzing risk requires a measurement of the risk itself,
and there are two different ways we can measure risk,
qualitatively or quantitatively.
Qualitative risk analysis uses intuition, experience,
and other best practices to assign non-numeric values
to a given risk.
These non-numeric values could be low, medium, high,
and critical, or you could use another categorization system
if you want.
Best practices for assigning qualitative risk values include
brainstorming sessions, focus groups, surveys, interviews,
or an estimation of the likelihood an event will occur using
the Delphi method.
The Delphi method involves asking a group
of experts multiple questions through multiple rounds
to reach a consensus.
In a qualitative assessment,
things are measured based on a feeling
or an opinion about how risky something really is.
In the case of qualitative methods,
we aren't looking for an exact dollar amount or metric.
Instead, we are trying to get an understanding
of how risky something is in relation to other things.
For example, we could use words like critical, high, medium,
or low to describe the risk.
Experience and expertise are heavily relied on
in qualitative risk assessments.
The biggest downside to using qualitative risk analysis is
that dollar values are not provided,
and this hinders our cost benefit analysis
and future budget forecasting.
Now, on the other hand,
we could use quantitative risk analysis.
This uses numeric and monetary values
for all parts of the risk analysis.
It includes assigning numerical values to the value
of assets, threat frequency, severity of vulnerabilities,
and the impact of the realization of a given threat.
Quantitative risk analysis removes a lot of the estimation
and guesswork from the risk analysis
because it basically turns a risk assessment
into a big math problem.
We have equations that we use to determine the total
and residual risk.
Quantitative risk analysis can provide us
with a cost directly associated with each of those risks,
which the accountants really love.
In the real world, most determinations
and risk analysis are going to include both quantitative
and qualitative analysis.
This is called a hybrid approach.
A hybrid approach is used
because there's often not enough data
to accurately use only a quantitative method.
The quantitative evaluation has to be combined
with some qualitative analysis.
There's always some level
of subjectivity in the data,
making most analysis a combination of both quantitative
and qualitative measurement.
But in the end, both quantitative
and qualitative risk analysis provide an end result
that helps prioritize a risk against other risks.
Risk prioritization is used
to rank risks based on their likelihood
and the impact they could have on an organization.
Quantitative analysis results are numbers.
This risk will cost me this much money.
In qualitative analysis, I get a feeling,
this feels like higher risk or medium or low risk.
From there, risk prioritization is about understanding
which risks pose the greatest threat
and require immediate attention,
and which ones are less critical and can be handled later,
or managed with less urgency.
Think of it like creating a to-do list
for dealing with problems.
The issues that are both very likely to happen
and would have severe consequences are placed
at the top of the list.
On the other hand, if something is unlikely to occur
or wouldn't cause much damage, if it did,
it goes lower on the list.
In this way, prioritizing risks helps organizations allocate
their resources effectively, ensuring
that the most serious threats are addressed first,
while not wasting effort on lower priority issues.
It's a balancing act that allows
for a more strategic efficient approach to risk management.
But the amount of risk
that one person might find unacceptable
might be totally acceptable to another person.
So we must also understand
our own risk appetite and tolerance.
Risk appetite and risk tolerance
are closely related concepts
that help organizations determine
how much risk they're willing to accept.
Risk appetite is the overall amount
of risk an organization is comfortable taking
to achieve its goals.
It's like setting a boundary
for how adventurous a company is willing to be
in pursuit of opportunities.
On the other hand, risk tolerance is more specific
and relates to the level
of variation an organization is willing
to handle within that boundary.
It refers to how much risk needs to change
before corrective action is necessary.
Essentially, risk appetite is the big picture of
how much risk an organization is willing to take on,
while risk tolerance measures the risk fluctuations
at a day-to-day level, if the fluctuations become too much,
then action will need to be taken.
It's like deciding how far off course you're willing
to let things drift
before stepping in to correct the situation.
So remember, risk assessment is a process used to identify,
evaluate, and manage potential threats to an organization.
It involves both quantitative
and qualitative analysis to assess risks
and determine their likelihood and potential impact.
Through this process, risks are prioritized,
allowing organizations to allocate resources effectively
and focus on the most critical threats first.
Understanding an organization's risk appetite
and risk tolerance is also important as they help define
how much risk that organization is willing to accept
while pursuing its goals.