Risk

The difference between a threat, vulnerability, and a risk

• A threat is something that could cause harm like a cyber criminal or ransomware

• A vulnerability is a weakness that could be exploited, such as an unpatched system or excessive access

• A risk is the likelihood an impact of that threat using the vulnerability to cause harm

Inherent vs residual risk

• Inherent risk is the raw exposure before controls are applied

• Residual risk is what remains after existing controls are in place

  
  

What is risk appetite?

The overall amount and type of risk an organization is willing to accept.

What are the four risk responses?

• Avoid: stop de activity

• Mitigate: add controls to lower the likelihood or impact

• Transfer: shift shifted, like insurance or a contract

• Accept: knowingly live with it, documented and signed by the owner

Qualitative vs quantitative risk

Qualitative: high/medium/low ratings, fast, works with limited data

Quantitative: dollar figures, like annual loss, expectancy, more precise, needs more data

Most teams start qualitative

Walk me through how you’d run a risk assessment

• I define scope and context: what system, data or process, and what the business cares about

• Identify assets, threats, and vulnerabilities

• Analyze likelihood and impact, then score the risk

• Prioritize and choose treatment, ,accept, mitigate, transfer, or avoid

• Document in the risk register, assigned owners, and monitor

How do you document a risk?

I make the document clear enough that someone who is not in the meeting can understand the issue quickly I include:

• What could happen?

• What systems, data, service, or process is affected

• What evidence supports the concern

• What controls exist, and what gap remains

• What action is recommended, who owns it, and when It needs review

What if a stakeholder disagrees with your risk rating?

• First, I’d understand why. They may have additional context, compensating controls, or operational information that wasn’t included initially.

• I review the evidence together, explain the methodology, and update the assessment if the new information supports it

• If there’s still disagreement, I document both views and escalate through the governance process for a decision

How do you prioritize risk?

• I scored each risk on likelihood and impact, then adjust for how critical the system or data is to the business

• The highest score gets a treatment, an owner, and a date first

• Anything blocking someone, or likely to cause harm soon, moves up regardless of score

What if someone pushes back on remediation?

• If the fix isn’t practical, I’d look at a compensating control that covers the gap another way

• If it’s about whether the finding is right, I’d go through the evidence and method

• If we still can’t close it, I’d get a formal risk acceptance from the right owner

• If we still disagree, I document both views and escalate to whoever owns the decision

How do you keep a risk register current?

• Every risk has an owner and a review date so nothing sits untouched

• Continuous monitoring feeds the register, so new risks and changes show up as they happen

• My evidence collector runs weekly, so the evidence behind each risk stays fresh

Explain a risk to an executive

• I’d start with what could happen, in business terms and not technical ones

• Then I’d give the impact, the action I recommended, who owns it, and by when