Topics in this domain
- IT Risk Events, Loss Types and Business Outcomes
- Threat Sources, Actors and Motivations
- The Changing Threat Landscape and Threat Modelling
- Vulnerabilities, Control Deficiencies and Risk Conditions
- Identifying Internal and External Risk Factors
- Building IT Risk Scenarios
- Evaluating Scenarios for Completeness and Relevance
- Common Risk Scenario Errors
- Risk Assessment Concepts and Standards
- Qualitative, Semi-Quantitative and Quantitative Analysis
- Quantitative Methods: ALE, FAIR and Monte Carlo
- Risk Analysis Techniques: Bow-Tie, Fault Tree, Event Tree and Delphi
- Choosing a Consistent Assessment Methodology
- Translating Technical Events into Business Impact
- Business Impact Analysis for Risk Prioritisation
- Inherent and Residual Risk
- Evaluating Risk Against Business Objectives and Appetite
- Creating and Maintaining the IT Risk Register
- Using the Risk Register to Support Decisions
IT Risk Events, Loss Types and Business Outcomes
From cause to outcome
A risk event is the moment something goes wrong. Describe the whole chain, from cause to business outcome, or you’ll end up treating symptoms. A vulnerability is a cause, not an event.
Families of IT risk events
Using common categories makes the register consistent and lets risks be aggregated.
Types of loss
Example. A ransomware attack cost a retailer 300,000 in IT recovery. The secondary losses were larger: 1.2 million in lost sales, a regulatory fine and a measurable drop in repeat customers.
IT risk is broader than security
- Benefit risk: IT investments that don’t deliver value.
- Delivery risk: projects that are late, over budget or fail.
- Operations risk: outages, errors and poor performance.
- Security and compliance risk: breaches and fines.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Loss MOST often underestimated | Secondary losses: fines, reputation, lost customers |
| BEST way to describe a risk event | Cause, event and business consequence |
| Benefit of standard event categories | Consistent register and aggregation |
| Is a failed IT project an IT risk? | Yes: delivery and benefit risk |
In short
- A risk event is the moment something goes wrong; describe the chain from cause to event to business outcome.
- IT risk events include attacks, errors and failures, supplier failures, project failures, compliance breaches, physical events and obsolescence.
- Using common event categories makes the register consistent and easier to aggregate.
- Losses include productivity, response, replacement, fines, competitive advantage and reputation.
- Secondary losses such as fines and lost customers are often larger than the direct costs.
- IT risk includes missed opportunities and failed projects, not just security incidents.
Exam traps
- Counting only the direct technical cost of an event.
- Treating IT risk as only security risk.
- Describing the cause (a vulnerability) as if it were the event.
- Stopping the analysis at the technical effect instead of the business outcome.
Slides
Click the slide and use the arrow keys. F toggles full screen.
From cause to outcome
Families of IT risk events
Types of loss
ExampleA ransomware attack cost a retailer 300,000 in IT recovery. The secondary losses were larger: 1.2 million in lost sales, a regulatory fine and a measurable drop in repeat customers.
1 / 8