What Is Risk?

Risk is the chance that the outcome differs from what is expected.
Usually, when we talk about business risk, we are referring to possible
negative impact and consequences of an event or decision.
In business, there will always be a certain degree of risk that any
organization must face to achieve its goals. At the essence, risk is a
fundamental requirement for growth, development, profit and
prosperity. In a broad range of every business industry, including
healthcare, finance, accounting, technology and supply chain,
effectively managed risks provide pathways to success. But like any
path, you need to know all the divots, detours, and dangers along the
way.
Even though risks are a part of doing business, we must find ways
to identify and manage those risks swiftly and effectively since they can
often develop out of nowhere, creating the possibility for greater risks
and damages. It is crucial to find ways to manage risks with the goal of
minimizing their threats and maximizing their potential.
Risks come from a variety of sources, which include the following:
 Uncertainties in financial markets and the economy.
 Threats associated with project failures at any phase, which
includes design, development, production, or maintenance of life
cycles.
  Legal liabilities.
 Credit risk.
 Threat of natural or man-made disasters.
 Security and cybersecurity risk.
 Impact of uncertain or unpredictable events, such as a pandemic.
 Competitive risk.
 Fallout from a company’s damaged reputation.
 Compliance risk.
 Third-party risk that comes with relying on external suppliers
and vendors.
To help you better understand various risks, there is a set of
international standards for information security that can help.
Together, the International Organization for Standardization (ISO) and
the International Electrotechnical Commission (IEC) create and publish
the ISO 270000 standards cooperatively for better guidance.
What Is the Difference Between Risk Assessment, Risk Management
and Risk Analysis?
It can become confusing trying to sift through the different
terms dealing with risk, including risk assessment, risk management,
and risk analysis. The main difference is breadth.
 1. Risk management is the macro-level process of assessing,
analyzing, prioritizing, and making a strategy to mitigate threats to
an organization’s assets and earnings.
2. Risk assessment is a meso-level process within risk management.
It aims to breaks down threats into identifiable categories and
define all the potential impact of each risk.
3. Risk analysis is the micro-level process of measuring risks and
their associated impact.
Let’s take a closer look at what differentiates these terms.
Risk Management
“The purpose of risk management is not to change the future, not to
explain the past.” – Dr. Dan Borge, a financial expert and
former aeronautical engineer who designed the RAROC risk-
management system and wrote The Book of Risk.
Instead, risk management is the overarching umbrella when it comes
risk. It includes both risk assessment and risk analysis.
Management involves the identification, analysis, evaluation, and
prioritization of current and potential risks. This allows you
to address loss exposures, monitor risk control and financial
resources in order to minimize possible adverse effects of potential
loss. Further, a solid risk management strategy gives you the ability to
maximize the realization of available opportunities to avoid risk.
Risk Assessment
Risk assessment helps you identify and categorize risks. Plus,
it provides an outline for potential consequences.
Performing a risk assessment involves processes and technologies that
help identify, evaluate and report on any risk-related concern.
According to NIST 800-30, risk assessment is a “key component” of the
risk management process and is primarily focused on the identification
and analysis phases of risk management.
If we take the example of a security risk assessment, it involves the
following steps:
 Identify the critical assets and sensitive data,
 Build a risk profile for each asset,
 Determine cybersecurity risks for each asset,
 Mapping how critical assets are linked,
 Prioritize which assets to address in case of a security threat,
  Create a mitigation plan with security controls to eliminate or
mitigate the impact of each risk,
 Continually monitor risks, threats, and vulnerabilities.
Risk Analysis
Risk analysis is the crucial evaluation component within the broader
risk management and assessment processes. Risk
analysis determines the significance of identified risk
factors identified in the risk assessment process and provides. Plus, it
qualifies risk, measuring the likelihood of hazards occurring and
tolerances for certain events. One example is when an auditor
calculates the probability and magnitude of a potential loss.
entified takes into account the likelihood of occurrence and
the estimated extent of possible impact. Together, t What is risk
mitigation?

Risk mitigation is a strategy to prepare for and lessen the effects of

threats faced by a business. Comparable to risk reduction, risk
mitigation takes steps to reduce the negative effects of threats and
disasters on business continuity (BC). Threats that might put a business
at risk include cyberattacks, weather events and other causes of
physical or virtual damage.
Risk mitigation is one element of risk management and its
implementation will differ by organization.
What is the goal of risk mitigation?
Risk mitigation is the process of planning for disasters and having a way
to lessen negative impacts.
Although the principle of risk mitigation is to prepare a business for all
potential risks, a proper risk mitigation plan will weigh the impact of
each risk and prioritize planning around that impact. Risk mitigation
focuses on the inevitability of some disasters and is used for those
situations where a threat cannot be avoided entirely. Rather than
planning to avoid a risk, mitigation deals with the aftermath of a
disaster and the steps that can be taken prior to the event occurring to
reduce adverse and, potentially, long-term effects.
Ideally, an organization would be prepared for all risks and threats and
avoid them entirely. However, having a risk mitigation plan can help an
organization prepare for the worst, acknowledging that some degree of
damage will occur and having systems in place to confront that.
A diagram laying out the steps in risk mitigation plan development.
What's in a risk mitigation plan?
When creating a risk mitigation plan, there are a few steps that are
fairly standard for most organizations. Recognizing recurring risks,
prioritizing risk mitigation and monitoring the established plan are vital
aspects to maintaining a thorough risk mitigation strategy.
There are five general steps in the design process of a risk mitigation
plan:
1. Identify all possible events in which risk is presented. A risk
mitigation strategy takes into account not only the priorities and
protection of mission-critical data of each organization, but any risks
that might arise due to the nature of the field or geographic location.
A risk mitigation strategy must also factor in an organization's
employees and their needs.
2. Perform a risk assessment, which involves quantifying the level of
risk in the events identified. Risk assessments involve measures,
processes and controls to reduce the impact of risk.
3. Prioritize risks, which involves ranking quantified risk in terms of
severity. One aspect of risk mitigation is prioritization -- accepting an
amount of risk in one part of the organization to better protect
another. By establishing an acceptable level of risk for different
areas, an organization can better prepare the resources needed for
BC, while putting fewer mission-critical business functions on the
back burner.
4. Track risks, which involves monitoring risks as they change in
severity or relevance to the organization. It's important to have
strong metrics for tracking risk as it evolves, and for tracking the
plan's ability to meet compliance requirements.
5. Implement and monitor progress, which involves reevaluating the
plan's effectiveness in identifying risk and improving as needed.
In business continuity planning, testing a plan is vital. Risk mitigation
is no different. Once a plan is in place, regular testing and analysis
should occur to make sure the plan is up to date and functioning
well. Risks facing data centers are constantly evolving, so risk
mitigation plans should reflect any changes in risk or shifting
priorities.
Types of risk mitigation strategies
There are several types of risk mitigation strategies. Often, these
strategies are used in combination with each other, and one may be
preferable over another, depending on the company's risk landscape.
They are all part of the broader practice of risk management.
 Risk avoidance is used when the consequences are deemed too high
to justify the cost of mitigating the problem. For example, an
organization can choose not to undertake certain business activities
or practices to avoid any exposure to the threat they might pose.
Risk avoidance is a common business strategy and can range from
something as simple as limiting investments to something as severe
as not building offices in potential war zones.
 Risk acceptance is accepting a risk for a given period of time to
prioritize mitigation effort on other risks.
 Risk transfer allocates risks between different parties, consistent
with their capacity to protect against or mitigate the risk. One
example of this would be a defective product built with some
amount of third-party material. The producer of the product may
transfer responsibility for a certain fraction of the risk because of
this.
 Risk monitoring is the act of watching projects and the associated
risks for changes in the impact of the associated risks.
Risk can affect any combination of performance, cost and scheduling;
therefore, different strategies should be used to address risks based on
the way they affect these factors. For example, it might be more
important for a company to perform well than for it to save money in a
certain project scenario. The company would likely employ a risk
acceptance strategy, temporarily prioritizing risks that affect
performance more heavily than cost.

A
diagram showing how quantitative risk assessment can be used to
evaluate the likelihood and impact of risk events.
Risk mitigation best practices
Below are some risk mitigation best practices that information security
professionals should follow:
 Make sure stakeholders are involved at each step. Stakeholders
may be employees, managers, unions, shareholders or clients. All
 perspectives are important for developing a comprehensive, holistic
risk mitigation strategy.
 Create a strong culture around risk management. This means
communicating the values, attitudes and beliefs surrounding risk and
compliance from the top down. It's important for every employee to
have risk awareness, but the probability of a strong culture is greatly
improved when management sets the tone.
 Communicate risks as they arise. Risk awareness must be strong
throughout the entire organization, so facilitating communication of
new, high-impact risks is important to keep everyone up to speed.
 Ensure risk management policy is clear so employees are able to
follow it. Roles and responsibilities should be clearly defined, and
each defined risk needs a clear process for dealing with it.
 Continuously monitor possible risks. Risk monitoring practices
should also be clearly defined and implemented to continuously
improve the risk mitigation plan.
Risk mitigation tools
One commonly used risk mitigation tool is a risk assessment
framework (RAF). An RAF provides an organization with an outline of
which systems are at high or low risk and presents information for both
technical and nontechnical personnel. An RAF can be used as a risk
mitigation tool by presenting consistent risk assessment and reporting
methods.
Common RAFs include the Risk Management Guide for Information
Technology Systems from the National Institute of Standards and
Technology (NIST); the Operationally Critical Threat, Asset, and
Vulnerability Evaluation (OCTAVE) from Carnegie Mellon University;
and Control Objectives for Information and Related Technology (COBIT)
from the Information Systems Audit and Control Association (ISACA).
The Mitre website also offers comprehensive guidelines for risk
mitigation.
Some other commonly used risk mitigation tools are:
 A probability and impact matrix.
 A SWOT (strengths, weaknesses, opportunities, threats) analysis.
 A root cause analysis.