Practical Risk Management Guide

Every stage of the risk lifecycle has working material here: techniques for identifying risks, how to structure business and technical risk assessments, quantitative and qualitative assessment methods, criteria for choosing a treatment, and approaches to monitoring and communicating risk, with worked examples you can adapt to your own register. Risk assessments are also a standard part of audit preparation, where they complement the gap analysis by surfacing threats the framework requirements alone will not.

Risk Identification Techniques

Threat Modeling Approach

When to use: New systems, applications, or significant changes

Process:

1. Asset Inventory: List what you're protecting (data, systems, processes)
2. Threat Actor Analysis: Who might attack (internal, external, nation-state, criminals)
3. Attack Vector Mapping: How they might attack (network, application, physical, social)
4. Impact Analysis: What happens if they succeed

Example Output:

Asset: Customer Credit Card Database
Threat: External cybercriminals
Attack Vectors:
- SQL injection through web application
- Privilege escalation through stolen credentials
- Network lateral movement from compromised workstation
Impact:
- $2M+ in PCI fines
- $500K+ in incident response costs
- Brand reputation damage
- Customer churn

Compliance Gap Analysis

When to use: Preparing for new regulations or standards

Process:

1. Requirement Mapping: Map each compliance requirement to current controls
2. Gap Identification: Find requirements without adequate controls
3. Risk Assessment: Evaluate risks of non-compliance
4. Prioritization: Focus on highest-risk gaps first

Example:

GDPR Article 32 - Security of Processing
Current State: Basic encryption, no key rotation
Gap: Lack of encryption key management
Risk: €20M fine potential + data breach exposure
Priority: High (implement within 90 days)

Business Process Risk Review

When to use: Regular business reviews or process changes

Focus Areas:

• Financial processes: Fraud, errors, unauthorized transactions
• HR processes: Insider threats, privileged access abuse
• IT operations: System failures, data loss, security breaches
• Vendor relationships: Third-party failures, data exposure

Structuring a Risk Assessment

Every organization should be performing some type of risk assessment. Assessments vary in nature and degree, but they should lay out risks from both a business and a technical perspective. A business impact analysis (BIA) complements this by determining the potential impacts resulting from the interruption of time-sensitive or critical business processes.

Business Risk Assessment

A business risk assessment should address the following:

Assessment Area	What to Cover
Insider threats	Risks posed by employees, contractors, and others with internal access
Business continuity & crisis	The organization's ability to continue operating through disruptions and crises
Legal risks	Data privacy and compliance with federal, state, and country-specific laws
Cyber insurance	Coverage appropriate to your industry vertical
Data mapping	Where data resides, especially customer data
Managed services	Risks arising from reliance on managed service providers
Sub organization processors	Third parties that process data on the organization's behalf

Lead these discussions with the business and document the results. From these conversations, you will be able to lay out the risks the organization is susceptible to from a business perspective.

Technical Risk Assessment

The technical risk assessment spans multiple domains, and the depth can vary. A typical one covers asset management, identity and access management, user access reviews, third-party penetration testing, vulnerability scanning, log aggregation, intrusion detection and prevention, code vulnerability scanning, and change management.

Those domains will not fit every organization; treat them as a guide. At a minimum, we recommend every organization run internal vulnerability scans of its infrastructure, scan code before it deploys to production, and have a penetration test performed by a third party. Log aggregation deserves attention too, as the way to detect and respond to events before they become critical; it can be expensive, so aim for a solution that fits the organization's budget and needs.

Reporting the Results

After both assessments are complete, review the findings, assign each risk a score based on your defined matrix (see the methodologies below), and communicate the findings to the organization before moving to remediation. The report to the management team should address critical and high findings first, then medium. Low findings belong in the overall report but are typically redacted from the management or executive summary unless the management team asks for them.

Listing the mitigating control function alongside each risk makes the remediation conversation concrete:

Severity	Identified Risk	Probability of Risk Occurring	Mitigating Control Type
Critical	"Risk 1"	23%	Corrective
High	"Risk 2"	85%	Compensating
Medium	"Risk 3"	15%	Detective
Low	"Risk 4"	27%	Preventative, Detective

Some of the controls you develop to mitigate risk will affect budget. Make sure the management team understands that deficiencies can cost money and resources to fix.

Risk Assessment Methodologies

Quantitative Risk Assessment

Best for: Financial risks, business-critical systems

Formula: Risk = Probability × Impact (in dollars)

Example Calculation:

Scenario: Ransomware Attack
Probability: 15% per year (based on industry data)
Impact Components:
- System downtime: $50,000/day × 3 days = $150,000
- Recovery costs: $75,000
- Regulatory fines: $200,000
- Reputation damage: $300,000
Total Impact: $725,000

Annual Risk Exposure: 15% × $725,000 = $108,750

Decision Making:

• If mitigation costs < $108,750, implement controls
• If mitigation costs > $108,750, consider accepting or transferring risk

Qualitative Risk Assessment

Best for: Emerging threats, reputation risks, complex scenarios

Assessment Matrix:

Impact	Very Low	Low	Medium	High	Very High
Critical	5	10	15	20	25
High	4	8	12	16	20
Medium	3	6	9	12	15
Low	2	4	6	8	10
Very Low	1	2	3	4	5

Scoring Guidelines:

Impact levels:

Level	Meaning
Critical (5)	Existential threat to organization
High (4)	Severe operational or financial impact
Medium (3)	Moderate impact, manageable consequences
Low (2)	Minor impact, minimal disruption
Very Low (1)	Negligible impact

Likelihood levels:

Level	Meaning
Very High	Almost certain to occur within 1 year
High	Likely to occur within 1-2 years
Medium	Possible within 2-5 years
Low	Unlikely within 5 years
Very Low	Rare or theoretical

Risk Treatment Decision Framework

When to ACCEPT Risk

Criteria:

• Risk score ≤ 6 (Low × Medium or below)
• Cost of mitigation > potential impact
• Risk aligns with organization's risk appetite
• No regulatory requirements for mitigation

Example:

Risk: Employee personal device theft
Impact: Low (devices have remote wipe capability)
Likelihood: Medium (theft does happen)
Score: 6
Decision: Accept with monitoring
Rationale: Remote wipe capability limits exposure

If you accept a risk while preparing for an audit, document the acceptance and explain it to the audit team. The goal is not to mitigate every risk, but the acceptance needs to be a deliberate, understood decision, and an acceptance that causes a common criterion to fail can lead to a qualified audit opinion.

When to MITIGATE Risk

Criteria:

• Risk score ≥ 12 (High impact or likelihood)
• Cost-effective mitigation available
• Regulatory compliance requires it
• Risk affects critical business operations

Example:

Risk: Database SQL injection
Impact: Critical (customer data exposure)
Likelihood: High (common attack vector)
Score: 20
Decision: Implement parameterized queries + WAF
Cost: $50,000 implementation + $20,000/year
Benefit: Reduces risk score to 4

When to TRANSFER Risk

Criteria:

• High financial impact but low likelihood
• Specialized risks outside expertise
• Cost of insurance < cost of mitigation
• Contractual requirements allow transfer

Example:

Risk: Natural disaster affecting data center
Impact: Critical ($2M+ business interruption)
Likelihood: Very Low (1 in 100 year event)
Decision: Business interruption insurance
Cost: $25,000/year premium
Coverage: $5M business interruption

When to AVOID Risk

Criteria:

• Risk is unacceptable and unmitigatable
• Activity provides low business value
• Regulatory environment too risky
• Reputational risks too high

Example:

Risk: Cryptocurrency trading platform
Regulatory Risk: Unclear/changing regulations
Reputational Risk: Association with criminal activity
Decision: Avoid - don't enter this market
Rationale: Risk/reward ratio unfavorable

Risk Monitoring and KPIs

Leading Indicators (Predict Future Risk)

• Security awareness training completion rates
• Patch management timelines
• Configuration drift detection
• Vendor security assessment scores
• Employee security incident reporting rates

Lagging Indicators (Show Past Performance)

• Actual security incidents
• Audit findings and violations
• Insurance claims filed
• Regulatory fines and penalties
• Customer complaints related to security/privacy

Risk Trend Analysis

Monthly Risk Dashboard:

New Risks Identified: 5
Risks Closed/Mitigated: 3
Risk Score Trends:
- Critical risks: 2 (no change)
- High risks: 8 (+2 from last month)
- Medium risks: 15 (-1 from last month)
- Low risks: 22 (+3 from last month)

Top Emerging Risks:
1. Supply chain compromise (new vendor)
2. Remote work security gaps
3. Cloud misconfiguration drift

Risk Communication Strategies

Executive Risk Reporting

Format: One-page dashboard with:

• Top 5 risks by score
• Risk trend over last 6 months
• Key risk indicators (green/yellow/red)
• Required decisions or approvals
• Budget implications

Sample Executive Summary:

Q1 2024 Risk Summary:
CRITICAL: Vendor X security incident affecting our data
HIGH: Increasing phishing attacks (25% uptick)
MEDIUM: Cloud migration risks well-managed

Action Required:
- Approve $100K for vendor security assessment
- Decision needed on cyber insurance increase

Operational Risk Reporting

Format: Detailed risk register with:

• Current mitigation status
• Control effectiveness metrics
• Action plan progress
• Resource requirements
• Timeline updates

Board-Level Risk Reporting

Format: Quarterly strategic overview:

• Top enterprise risks and quarter-over-quarter trend
• Risk appetite vs. actual exposure
• Regulatory compliance status
• Competitive risk positioning
• Long-term risk strategy