Topics in this domain
- IT Risk Events, Loss Types and Business Outcomes
- Threat Sources, Actors and Motivations
- The Changing Threat Landscape and Threat Modelling
- Vulnerabilities, Control Deficiencies and Risk Conditions
- Identifying Internal and External Risk Factors
- Building IT Risk Scenarios
- Evaluating Scenarios for Completeness and Relevance
- Common Risk Scenario Errors
- Risk Assessment Concepts and Standards
- Qualitative, Semi-Quantitative and Quantitative Analysis
- Quantitative Methods: ALE, FAIR and Monte Carlo
- Risk Analysis Techniques: Bow-Tie, Fault Tree, Event Tree and Delphi
- Choosing a Consistent Assessment Methodology
- Translating Technical Events into Business Impact
- Business Impact Analysis for Risk Prioritisation
- Inherent and Residual Risk
- Evaluating Risk Against Business Objectives and Appetite
- Creating and Maintaining the IT Risk Register
- Using the Risk Register to Support Decisions
Identifying Internal and External Risk Factors
What risk factors are
Risk factors are conditions that make an event more likely or more damaging. They aren’t events themselves. High staff turnover in IT doesn’t cause an outage, but it makes one more likely and slower to fix.
Internal and external
Using risk factors
- Adjust likelihood and impact estimates.
- Spot when ratings need review.
- Choose leading key risk indicators.
- Explain why a risk is rising or falling.
Example. An organisation loses three of its five database administrators in six months. No incident has happened, but the practitioner raises the likelihood of outage and data integrity scenarios and adds DBA vacancy rate as a KRI.
Factor versus event
| Risk factor | Related risk event |
|---|---|
| Ageing, unsupported systems | System failure or exploited vulnerability |
| New data protection law | Regulatory breach and fine |
| Rapid growth in change volume | Failed change causes an outage |
| Key supplier in financial trouble | Supplier stops delivering the service |
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Purpose of identifying risk factors | Make likelihood and impact estimates realistic |
| Significant change in a risk factor | Review the related risk ratings |
| Good source of leading KRIs | Risk factors |
| External factors you can’t control | Still monitor them and include them in the assessment |
In short
- Risk factors are conditions that change the likelihood or impact of risk events.
- Internal factors include strategy, culture, system complexity, skills, change volume and control maturity.
- External factors include the threat landscape, regulation, the economy, supplier health and technology trends.
- Changes in risk factors are early signals that risk ratings need reviewing.
- Many risk factors make good key risk indicators.
Exam traps
- Rating risk only on technical facts and ignoring organisational factors like skills or culture.
- Ignoring external factors because the organisation can't control them.
- Leaving ratings unchanged after a major change in risk factors.
- Confusing a risk factor with a risk event.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Internal and external
1 / 8