Topics in this domain
- Exam Technique: Thinking Like a Risk Practitioner
- Aligning IT Risk Management with Business Strategy
- Organisational Structure, Roles and Decision Rights
- Risk Ownership and Accountability
- Segregation of Duties
- Risk Culture and Tone at the Top
- Ethics and Professional Conduct
- Policies, Standards, Procedures and Guidelines
- Policy Lifecycle, Exceptions and Enforcement
- Business Process Review: Ownership and Criticality
- Identifying and Valuing Organisational Assets
- Embedding Asset Management into Risk Governance
- Enterprise Risk Management: Purpose and Principles
- The Risk Practitioner's Role in ERM
- The Three Lines Model and Risk Oversight
- Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT
- Applying a Framework: the Risk Management Life Cycle
- Risk Appetite, Tolerance and Capacity
- Establishing and Maintaining the IT Risk Profile
- Making Risk-Based Business Decisions
- Legal, Regulatory and Contractual Requirements
- Connecting Governance to Risk Outcomes
Identifying and Valuing Organisational Assets
What counts as an asset
Finding assets
- Automated discovery on networks and cloud accounts.
- Business process reviews and interviews.
- Procurement and contract records.
- Data discovery tools for sensitive information.
No single source is complete; the best inventories reconcile several.
Valuing assets
Example. A research team’s results database runs on a cheap server. Its value is set by what a competitor could do with unpublished results and the years of work it holds, which makes it one of the most valuable assets in the company.
Who values them
| Role | Contribution |
|---|---|
| Asset owner (business) | Sets value and classification |
| Risk practitioner | Provides the method and criteria; challenges |
| IT / custodian | Provides technical facts and dependencies |
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| BEST basis for asset value | Business impact of losing it |
| Who sets asset value | The business owner |
| FIRST step before assessing risk to assets | Identify and inventory them |
| MOST complete inventory method | Automated discovery reconciled with business input |
In short
- Assets include information, systems, infrastructure, people, suppliers and intangibles such as reputation.
- Identifying assets is an early step in risk assessment; you can't assess risk to something you don't know about.
- Value comes from business impact if confidentiality, integrity or availability is lost, not from purchase price.
- The asset owner, a business manager, sets value and classification with the practitioner's help.
- Automated discovery plus business input gives the most complete inventory.
Exam traps
- Valuing information by the cost of the server that stores it.
- Listing only hardware and software, missing data, people and suppliers.
- Building the inventory from purchase records alone.
- Letting IT set the value of business information.
Slides
Click the slide and use the arrow keys. F toggles full screen.
What counts as an asset
Valuing assets
ExampleA research team's results database runs on a cheap server. Its value is set by what a competitor could do with unpublished results and the years of work it holds, which makes it one of the most valuable assets in the company.
1 / 8