Topics in this domain
- IT Risk Events, Loss Types and Business Outcomes
- Threat Sources, Actors and Motivations
- The Changing Threat Landscape and Threat Modelling
- Vulnerabilities, Control Deficiencies and Risk Conditions
- Identifying Internal and External Risk Factors
- Building IT Risk Scenarios
- Evaluating Scenarios for Completeness and Relevance
- Common Risk Scenario Errors
- Risk Assessment Concepts and Standards
- Qualitative, Semi-Quantitative and Quantitative Analysis
- Quantitative Methods: ALE, FAIR and Monte Carlo
- Risk Analysis Techniques: Bow-Tie, Fault Tree, Event Tree and Delphi
- Choosing a Consistent Assessment Methodology
- Translating Technical Events into Business Impact
- Business Impact Analysis for Risk Prioritisation
- Inherent and Residual Risk
- Evaluating Risk Against Business Objectives and Appetite
- Creating and Maintaining the IT Risk Register
- Using the Risk Register to Support Decisions
Choosing a Consistent Assessment Methodology
Why consistency matters
If the finance team’s “high” means a 1 million loss and IT’s “high” means a server outage, nobody can compare risks or add them up. A common methodology makes results comparable across teams and across years.
Setting up the method
Describing the scales
| Impact level | Business description |
|---|---|
| 1 Minor | Under 50,000; no customer impact |
| 2 Moderate | 50,000-500,000; some customers affected |
| 3 Major | 0.5-5 million; regulator notified |
| 4 Severe | Over 5 million; licence or strategy at risk |
Labels alone (“medium”) mean different things to different people. Each level needs a description in business terms.
Keeping it consistent
- Document the methodology, with examples.
- Train everyone who assesses risk.
- Calibrate ratings in review sessions.
- Change the method only deliberately, and restate past results.
Example. Two business units rated an identical supplier risk as low and high. A calibration workshop using shared impact descriptions brought both to medium and exposed a gap in the training.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| BEST way to make risk results comparable | A common methodology and scales across the organisation |
| Two assessments differ widely | Check the methods, scales and assumptions |
| Most important feature of impact scales | Clear descriptions in business terms |
| Relationship with ERM | Use the same scales as enterprise risk |
In short
- Agree the method, scales and criteria before assessing.
- Likelihood and impact scales need clear descriptions in business terms for each level.
- Use the same scales as enterprise risk management so IT risks can be compared with other risks.
- Document the methodology and train assessors so different people reach similar results.
- Consistency over time lets trends be measured; change the method only deliberately.
Exam traps
- Letting each team use its own scales.
- Defining levels with labels only ('medium') and no descriptions.
- Changing the method every year, so trends can't be seen.
- Choosing a methodology because it's popular rather than because it fits.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Setting up the method
1 / 8