Risk management
Exam objective 5.2: Explain elements of the risk management process.
On this page
Risk management identifies risks, assesses them qualitatively or quantitatively, records them in a register, and treats them by transfer, acceptance, avoidance, or mitigation. Business impact analysis adds recovery targets such as RTO and RPO.
Assessment
Risk identification lists what could go wrong. Assessments can be ad hoc, one-time, recurring, or continuous. Qualitative analysis uses ratings like high, medium, low; quantitative analysis uses numbers.
| Term | Formula | Meaning |
|---|---|---|
| Single loss expectancy (SLE) | Asset value x exposure factor | Cost of one event |
| Annualized rate of occurrence (ARO) | Events per year | How often it happens |
| Annualized loss expectancy (ALE) | SLE x ARO | Expected cost per year |
Register, appetite, and treatment
A risk register records each risk with its owner, likelihood, impact, key risk indicators, and treatment. Risk appetite is how much risk the organization is willing to take; tolerance is the acceptable variation around it. Appetite can be expansionary, conservative, or neutral.
| Strategy | Meaning | Example |
|---|---|---|
| Transfer | Shift the financial impact to another party | Cyber insurance |
| Accept | Acknowledge and live with it, sometimes with an exemption or exception | Low-impact risk below appetite |
| Avoid | Stop the risky activity | Don't launch the feature |
| Mitigate | Reduce likelihood or impact with controls | Add MFA |
Business impact analysis sets recovery targets: recovery time objective (RTO, how fast a system must be back), recovery point objective (RPO, how much data loss is tolerable), mean time to repair (MTTR), and mean time between failures (MTBF).
Key terms
- Single loss expectancy (SLE)
- The expected monetary loss from one occurrence of a risk: asset value times exposure factor.
- Annualized rate of occurrence (ARO)
- The expected number of times a risk event happens in a year.
- Annualized loss expectancy (ALE)
- The expected yearly loss from a risk: single loss expectancy times annualized rate of occurrence.
- Risk register
- A document that records identified risks with owners, ratings, and treatments.
- Risk appetite
- The amount and type of risk an organization is willing to pursue or accept.
- Risk transfer
- Shifting the financial impact of a risk to another party, such as an insurer.
- Risk acceptance
- Acknowledging a risk and choosing not to act further because it's within appetite.
- Risk avoidance
- Eliminating a risk by stopping or not starting the activity that causes it.
- Risk mitigation
- Reducing a risk's likelihood or impact by applying controls.
- Recovery time objective (RTO)
- The maximum acceptable time to restore a system or process after a disruption.
- Recovery point objective (RPO)
- The maximum acceptable amount of data loss, measured as time since the last good copy.
- Mean time between failures (MTBF)
- The average operating time between failures of a repairable system.
- Qualitative risk analysis
- Assessing risk with descriptive ratings such as high, medium, and low instead of dollar values.
Check yourself
26 practice questions on this objective
Practice this objectiveFlashcards for this objective