Managing Risk

Risk management

is the process of systematically addressing the risks facing an organization

The risk assessment serves two important roles in the risk management process:

• The risk analysis provides guidance in prioritizing risks so that the risks with the highest probability and magnitude are addressed first

• Quantitative risk analysis help determine whether the potential impact of a risk justifies the costs incurred by adopting a risk management approach

Risk mitigation

is the process of applying security controls to reduce the probability and/or magnitude of a risk

Risk avoidance

is a risk management strategy where we change our business practices to completely eliminate the potential that a risk will materialize

Risk transference

shifts some of the impact of a risk from the organization experiencing the risk to another entity

Risk acceptance

• accept the risk, and simply continue operations as normal in the face of the risk. A ____ approach may be warranted if the cost of mitigating a risk is greater than the impact of the risk itself

• If a particular risk does not align with the established policy but the cost of mitigation is too high, an exception can be granted for that specific case

• Exemptions are similar to exceptions but are generally more formal