Topics in this domain
- IT Risk Events, Loss Types and Business Outcomes
- Threat Sources, Actors and Motivations
- The Changing Threat Landscape and Threat Modelling
- Risk Identification Techniques
- Vulnerabilities, Control Deficiencies and Risk Conditions
- Identifying Internal and External Risk Factors
- Root Cause Analysis for Risk Events and Control Failures
- Building IT Risk Scenarios
- Evaluating Scenarios for Completeness and Relevance
- Common Risk Scenario Errors
- Risk Assessment Concepts and Standards
- Qualitative, Semi-Quantitative and Quantitative Analysis
- Quantitative Methods: ALE, FAIR and Monte Carlo
- Risk Analysis Techniques: Bow-Tie, Fault Tree, Event Tree and Delphi
- Choosing a Consistent Assessment Methodology
- Translating Technical Events into Business Impact
- Business Impact Analysis for Risk Prioritisation
- Inherent and Residual Risk
- Evaluating Risk Against Business Objectives and Appetite
- Creating and Maintaining the IT Risk Register
- Using the Risk Register to Support Decisions
Risk Identification Techniques
Finding risk before it finds you
You can’t analyse, treat or report a risk that nobody has spotted. Risk identification is the step that feeds everything else: the scenarios, the analysis and the risk register all depend on it.
Good identification uses several techniques, involves the people who run the business, and keeps going as things change.
Example. A bank’s annual risk review lists 40 IT risks, all copied from a vendor checklist. None mention the 15-year-old system that runs mortgage payments, because nobody asked the mortgage team.
The main techniques
The diagram summarises six techniques with what each is best for and its main weakness. The table adds how each one works in practice.
| Technique | How it works | Strength | Weakness |
|---|---|---|---|
| Workshops | Cross-functional group discusses what could go wrong | Shared view and ownership | Loud voices, groupthink |
| Interviews | One-to-one with process owners and experts | Depth; sensitive topics | Slow; one person’s view |
| Checklists and risk libraries | Standard lists of known risks | Fast and consistent | Miss new or unusual risks |
| Incident and loss data | Internal incidents, near misses, industry loss data | Evidence of real events | Backward-looking |
| SWOT and PESTLE | Structured strategic and external scans | Strategic and external risks | Too high-level alone |
| Assessments and audits | Vulnerability scans, control reviews, audit findings | Concrete gaps | Limited to their scope |
The Delphi technique (anonymous rounds of expert opinion) and scenario analysis are also used to identify risk; they’re covered in the analysis techniques and scenario articles.
Top-down and bottom-up
- Top-down starts from business objectives and asks what could stop them. It keeps risk relevant and is easy for executives to engage with.
- Bottom-up starts from assets, threats and vulnerabilities. It finds the realistic, technical detail that top-down discussion misses.
The best answer usually combines both: business relevance from the top, realism from the bottom.
Scanning the outside world
SWOT (strengths, weaknesses, opportunities, threats) looks at the organisation’s own position. PESTLE (political, economic, social, technological, legal, environmental) scans the external environment. Both are good at finding strategic and external risk factors, but they need turning into specific risk scenarios before they’re useful in the register.
When to identify risk again
Identification isn’t a once-a-year event. Look again when there’s:
- a new project, system, supplier or business change
- a significant incident, especially one no scenario predicted
- new threat intelligence or a new regulation
- a key risk indicator (KRI) moving toward its threshold
- an audit or assessment finding
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| BEST way to identify IT risk | Combine techniques and involve business owners |
| Top-down vs bottom-up | Use both: relevance and realism |
| Weakness of checklists | They miss new or organisation-specific risks |
| Incident that matches no scenario | A gap in risk identification; update the register |
| Technique for external factors | PESTLE |
In short
- Risk identification finds what could affect objectives before it's analysed and evaluated.
- Common techniques: workshops, interviews, checklists and risk libraries, incident and loss data, assessments and audits, SWOT and PESTLE.
- Top-down techniques start from business objectives; bottom-up techniques start from assets, threats and vulnerabilities. Use both.
- Involve the business: the people who run a process know where it fails.
- Identification is continuous, triggered by change, incidents, new threats and new projects, not just an annual exercise.
Exam traps
- Relying on one technique, such as a generic checklist, misses risks specific to the organisation.
- IT alone identifying risk produces technical lists with no business context.
- Identifying risk only once a year leaves the register out of date.
- Treating an incident that matches no scenario as a one-off instead of a gap in identification.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Turn your phone sideways for a bigger view. Tap any diagram to enlarge it.
The main techniques
Scanning the outside world