1.2 Risk assessment approaches & processes

Question 1

What are the different risk assessment approaches?

Answer 1

Quantitative approaches
Heuristic approaches
Systems approaches
Mixed approaches
\+ lots of different techniques, tools & services / gurus

Question 2

What are the different types of quantitative approaches?

Answer 2

Risk exposure

Risk management

Question 3

Describe the different types of quantitative approaches

Answer 3

Risk exposure:
List all likely risk areas (data corruption, security breach, virus)
List likely risk items (power cut, deliberate / accidental disruption)
List likely outcome of risk (£, time, damage)
List exposure of risk (probability * likely cost)

Risk management:
Address the 'main' areas / concerns
Identify solutions
List / identify possible solutions
Analyse cost / benefits of solution
Identify common solution
Pick most appropriate solution
(A lot of pragmatism often comes into play in selecting solutions)

Question 4

What is Heuristic approaches, and describe what is involved?

Answer 4

Rule of thumb
Mostly quantitative approaches - checklists (areas involve reviewing system or controls, developed using previous experiences, lesson learnt from similar projects)
Similar to Internal Control Questionnaire (used in computer auditing)

Question 5

What are the different elements of risk management?

Answer 5

Insurance & risk mitigation
Adequate controls approach
Disaster recovery
Robust & sensitivity analysis

Question 6

Describe the different elements of risk management

Answer 6

Insurance & risk mitigation:
What can you insure against?

Adequate controls approach:
Can’t identify all risks - but can have good controls to monitor & detect problems
Particularly in areas of material risk

Disaster recovery:
Fall back procedures - plan of action
Good recovery plans

Robust & sensitivity analysis:
How sensitive is RA to changes in probability or impact

Question 7

How should you determine acceptable risk

Answer 7

Risk aversion - maximising reduction of risk
Risk balancing - same level of risk = acceptable, based on similar cases
Cost effectiveness - minimises risk per £, $ etc.
Cost-benefit balancing - balances benefits & costs of activity