Stop 11 · GRC: Governance, Risk & ComplianceTopics · 1/9

Risk Assessment & Management

In short

No company can fix everything at once. Risk assessment is how you decide what to protect first, so the small security budget goes where the real danger is.

Systematically identifying, evaluating, and prioritizing security risks based on likelihood and impact — the foundation for deciding where limited security budget and effort should actually go.

The blob as a cricket captain points to where a fielder should stand.

Think of it like this

The captain setting the field

A cricket captain has only eleven players. He studies the batter: where does he usually hit, and which gaps would cost the most runs? Fielders go there first. Risk management is the same: limited people, placed where trouble is both likely and costly.

Watch it happen

One risk, start to finish

Identify

Analyse

Prioritise

Treat

Monitor

1/5Spot a risk: the HR laptop holds salary files and is not encrypted.

The big ideas

What you need to know

Likelihood times impact

Risk is how likely something is multiplied by how much it would hurt. A rare but huge event can outrank a common tiny one.

Four treatments

You can reduce a risk, avoid it, transfer it (like insurance) or accept it. Accepting is fine when it is a written, owned decision.

Every risk has an owner

A named person, usually from the business, decides and answers for each risk. Security advises; the owner signs off.

Never one and done

New systems, vendors and threats appear all the time. Reassess regularly, not only after something breaks.

Save yourself the pain

Common mistakes

Oops

Ranking risks only by how scary they sound in the news.

Do this instead

Score each one for your own systems. A famous attack that cannot reach your setup may matter less than a boring open share.

Oops

Treating risk acceptance as ignoring the problem.

Do this instead

Acceptance is valid when the owner signs it, with a reason and a review date. Silent ignoring is not acceptance.

Your mission

Score five risks at home

~25 min

Quick check

Risk A: likelihood 5, impact 1. Risk B: likelihood 2, impact 5. Using likelihood times impact, which comes first?

Go deeper

1Build a simple risk matrix (likelihood x impact) and plot 5 hypothetical risks on it.
2Learn the difference between risk avoidance, mitigation, transfer, and acceptance.
3Practice justifying why a specific risk should (or shouldn't) be prioritized for remediation.