In an enterprise risk management ([[Enterprise Risk Management|ERM]]) program, organisations take a *formal approach to risk analysis* that begins with **identifying risks**, continues with **determining the severity of each risk**, and then results in **adopting one or more risk management strategies** to address each risk. Before we move too deeply into the risk assessment process, let's define a few important terms that we'll use during our discussion: - [[Threats]] are any possible events that might have an adverse impact on the confidentiality, integrity, and/or availability of our information or information systems. - [[Vulnerabilities]] are weaknesses in our systems or controls that could be exploited by a threat. - [[Risks]] occur at the intersection of a vulnerability and a threat that might exploit that vulnerability. A threat without a corresponding vulnerability does not pose a risk, nor does a vulnerability without a corresponding threat. ![[Threat Vulnerability and Risk.png]] ### Risk Analysis Risk analysis is a *formalised approach to risk prioritisation* that allows organisations to conduct their reviews in a structured manner. Risk assessments follow two different analysis methodologies: - **Quantitative** risk analysis uses numeric data in the analysis, resulting in assessments that allow the very straightforward prioritisation of risks. - **Qualitative** risk analysis substitutes subjective judgments and categories for strict numerical analysis, allowing the assessment of risks that are difficult to quantify. As organisations seek to provide clear communication of risk factors to stakeholders, they often combine elements of quantitative and qualitative risk assessments. Let's review each of these approaches. #### Quantitative Risk Analysis Most quantitative risk analysis processes follow a similar methodology that includes the following steps: 1. **Determine the asset value** (AV) of the asset affected by the risk. This asset value (AV) is expressed in dollars, or other currency, and may be determined using the *cost to acquire the asset, the cost to replace the asset, or the depreciated cost of the asset*, depending on the organisation's preferences. 2. **Determine the likelihood that the risk will occur**. Risk analysts consult subject matter experts and determine the likelihood that a risk will occur in a given year. This is expressed as the number of times the risk is expected each year and is described as the *annualised rate of occurrence* (ARO). A risk “that is expected to occur twice a year has an ARO of 2.0, whereas a risk that is expected once every one hundred years has an ARO of 0.01. 3. **Determine the amount of damage** that will occur to the asset if the risk materialises. This is known as the *exposure facto*r (EF) and is *expressed as the percentage of the asset* expected to be damaged. The exposure factor of a risk that would completely destroy an asset is 100 percent, whereas a risk that would damage half of an asset has an EF of 50 percent. 4. **Calculate the single loss expectancy**. The single loss expectancy (SLE) is the amount of financial damage expected each time a risk materialises. It is *calculated by multiplying the AV by the EF*. 5. **Calculate the annualised loss expectancy**. The annualised loss expectancy (ALE) is the amount of damage *expected from a risk each year*. It is calculated by multiplying the SLE and the ARO. Organisations can *use the ALEs* that result from a quantitative risk analysis **to prioritise their remediation activities** and determine the appropriate level of investment in controls that mitigate risks. #### Qualitative Risk Analysis Qualitative risk analysis techniques seek to overcome the limitations of quantitative techniques by *substituting subjective judgment for objective data*. Qualitative techniques still use the same probability and magnitude factors to evaluate the severity of a risk but do so using subjective categories. For example, below is a simple qualitative risk analysis that evaluates the probability and magnitude of several risks on a subjective Low/Medium/High scale. Risks are placed on this chart based on the judgments made by subject matter experts. ![[Qualitative Risk.png]]