Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Cost-Benefit Analysis of Risk Responses
Comparing options
Compare each option’s total annual cost with the reduction in risk it delivers, and always include “do nothing” so decision-makers see the residual risk of not acting.
Total cost of a response
- Purchase and licences.
- Implementation and integration.
- Staff time to operate and maintain it.
- Training and support.
- Business friction and lost productivity.
When numbers aren’t enough
- Legal requirements: some controls are mandatory whatever the cost-benefit.
- Safety: harm to people outweighs financial calculations.
- Reputation and trust: hard to quantify, but real.
Example. Encryption of a small patient database didn’t pass a pure ALE test, but the regulator required it. The decision was recorded as a compliance requirement, not a cost-benefit choice.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| BEST basis for choosing between controls | Risk reduction relative to total cost |
| Cost most often missed | Ongoing staff time and operation |
| Option every business case should include | Do nothing, with its residual risk |
| Control fails cost-benefit but is legally required | Implement it; compliance overrides |
In short
- Compare each option's total annual cost with the risk reduction it delivers.
- Include a 'do nothing' option so decision-makers can see the residual risk of not acting.
- Total cost includes purchase, implementation, staff time, maintenance and business friction.
- The best option is usually the one with the greatest net benefit that brings risk within appetite.
- Legal requirements, safety and reputation can justify controls the numbers alone don't support.
Exam traps
- Comparing control cost with total ALE instead of the reduction in ALE.
- Leaving out staff time and ongoing operating costs.
- Choosing the option that removes most risk even when it costs more than it saves.
- Ignoring legal or safety requirements because the numbers are unfavourable.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Comparing options
1 / 7