Kodstigen
← GRC Fundamentals

Lesson 3 of 6

Risk Management: Identifying, Assessing, and Treating Risk

Risk management is how an organization decides, deliberately, which problems are worth spending time and money to prevent, and which ones it can live with. Skipping this step doesn't make risk disappear, it just means nobody chose which risks to prioritize.

The risk register

A risk register is the central artifact of risk management, a living list of identified risks, each with:

  • A description of what could go wrong (e.g. "an employee's laptop with an unencrypted disk is lost or stolen").
  • Likelihood: how probable is this, on some agreed scale (e.g. Low/Medium/High, or 1-5).
  • Impact: how bad would it be if it happened, on the same kind of scale.
  • An owner: a specific person accountable for tracking and treating it, never "the team."
  • A treatment plan and status.

Likelihood × impact

Multiplying (or combining) likelihood and impact gives a rough risk score, used to prioritize attention, a risk that's both likely and severe (an internet-facing service with no authentication) needs addressing before a risk that's rare and minor (a typo in an internal wiki page).

Risk Score = Likelihood × Impact

This is deliberately approximate, the goal is a consistent way to rank many risks against each other, not a precise financial forecast.

The four ways to treat a risk

  1. Avoid: stop doing the thing that creates the risk entirely (e.g. don't collect data you don't need).
  2. Mitigate: reduce the likelihood or impact (e.g. add encryption, add monitoring, add a code review requirement).
  3. Transfer: shift the impact to someone else (e.g. cyber insurance, a vendor's SLA).
  4. Accept: consciously decide the risk is small enough, or expensive enough to fix, that the organization will live with it as-is, this must be a deliberate, documented decision, not silence.

WARNING

"We haven't gotten around to it yet" is not the same as "we accepted this risk." A real risk acceptance has an owner, a documented reason, and (usually) a review date, otherwise it's just an unmanaged risk wearing a friendlier label.

Risk appetite

An organization's risk appetite is how much risk it's willing to tolerate in pursuit of its goals, a startup shipping fast might accept risks a bank never would, appetite isn't right or wrong in the abstract, it just needs to be an explicit, leadership-level decision rather than whatever the last person in the room happened to prefer.

📝 Risk Management Quiz

Passing score: 70%

  1. 1.Which risk treatment option means consciously deciding to live with a risk as-is, with a documented reason?

  2. 2.What does a risk score in a risk register typically approximate?

  3. 3.A risk register entry should have a specific owner rather than being assigned to 'the team.'

  4. 4.An organization's ____ describes how much risk it's willing to tolerate in pursuit of its goals.