Risk Assessment

When we assess any risk, we do so by using two factors

• The likelihood of occurrence, or probability, that the risk will occur

• The magnitude of the impact that the risk will have on the organization if it does occur

Risk Severity =

Likelihood * Impact

One-time risk assessments

offer the organization a point-in-time view of it’s current risk state

Ad hoc risk assessments

are conducted in response to a specific event or situation

Recurring risk assessments

are performed at regular intervals, such as annually or quarterly

Continuous risk assessments

involve ongoing monitoring and analysis of risks

Quantitative risk analysis

uses numeric data in the analysis, resulting in assessments that allow the very straightforward prioritization of risks

Qualitative risk analysis

substitutes subjective judgments and categories for strict numerical analysis, allowing the assessment of risks that are difficult to quantify