Topics in this domain
- IT Risk Events, Loss Types and Business Outcomes
- Threat Sources, Actors and Motivations
- The Changing Threat Landscape and Threat Modelling
- Vulnerabilities, Control Deficiencies and Risk Conditions
- Identifying Internal and External Risk Factors
- Building IT Risk Scenarios
- Evaluating Scenarios for Completeness and Relevance
- Common Risk Scenario Errors
- Risk Assessment Concepts and Standards
- Qualitative, Semi-Quantitative and Quantitative Analysis
- Quantitative Methods: ALE, FAIR and Monte Carlo
- Risk Analysis Techniques: Bow-Tie, Fault Tree, Event Tree and Delphi
- Choosing a Consistent Assessment Methodology
- Translating Technical Events into Business Impact
- Business Impact Analysis for Risk Prioritisation
- Inherent and Residual Risk
- Evaluating Risk Against Business Objectives and Appetite
- Creating and Maintaining the IT Risk Register
- Using the Risk Register to Support Decisions
Evaluating Risk Against Business Objectives and Appetite
What evaluation does
Analysis gives each risk a rating. Evaluation asks what that rating means for the business: is it acceptable, does it need a response, and who must decide? The yardstick is the appetite and tolerance the board has set.
From rating to action
Prioritising
- Impact on business objectives comes first.
- Distance from appetite or tolerance.
- Speed of onset: how quickly harm arrives.
- Trends: is the risk rising?
Example. Two risks are both rated high. One threatens the company’s main growth objective and is rising; the other affects a system due to be retired in three months. The first is prioritised, and the second is accepted until retirement.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| After analysing a risk | Evaluate it against appetite |
| Risk well within appetite | Accept and monitor |
| MOST important basis for prioritising | Impact on business objectives |
| Risk beyond appetite | Treat it, or escalate to a level that can accept it |
In short
- Evaluation compares analysed risk with appetite and tolerance to decide whether a response is needed.
- Risks well within appetite are usually accepted and monitored; risks beyond it need treatment or escalation.
- Prioritise by impact on business objectives, not technical severity.
- The level of authority needed to decide rises with the size of the risk.
- Evaluation comes after analysis and before choosing a response.
Exam traps
- Choosing a response before comparing the risk with appetite.
- Prioritising by the order risks were found or by cost to fix.
- Treating all risks above zero as needing mitigation.
- Letting a low-level manager decide on a risk beyond appetite.
Slides
Click the slide and use the arrow keys. F toggles full screen.
From rating to action
1 / 7