Information Security Risk Management · Lesson 5 of 13
Describe a risk before assigning a score
21 minutes · Content checked 2026-10-17
AI editorial review completed — introductory draft; detailed revised-exam mapping unverified. Target edition: exams from 3 November 2026. Detailed revised-syllabus alignment remains pending.
Read the coverage and AI editorial review report
Loading progress…
Completion records your selection; it does not certify understanding or exam readiness.
What you will learn
- Write a risk scenario with a cause and business consequence.
- Evaluate existing safeguards and uncertainty.
- Explain the limits of a risk score.
Describe what could happen
A useful risk scenario connects an affected service or information asset to a plausible event and a business consequence. An outdated application is a condition; unauthorized access through that application could expose customer records and interrupt service. The second description gives an owner something to assess and act on.
Set the assessment boundary before collecting evidence. Identify the service, its dependencies, the information involved, and the decisions the assessment must support. Interview service owners and examine operational evidence rather than assuming the inventory is complete. Record assumptions so another reviewer can understand the assessment.
Assess likelihood and consequence
Likelihood depends on the scenario and the relevant conditions, not just the existence of a vulnerability. Consider exposure, plausible threat activity, and how safeguards operate. Evaluate consequences for confidentiality, integrity, availability, and business objectives. An internet-facing service and an isolated laboratory system can have different exposure even when they share a software defect.
Use a defined rating scale with examples. Qualitative categories support comparison but are not precise probabilities. Quantitative estimates can be useful when evidence supports them; include ranges and uncertainty. Do not multiply ordinal labels and present the result as an objectively measured financial loss.
Check the safeguards
Distinguish a safeguard described in a policy from one operating in practice. Review access records, configuration, testing, and known failures. A backup job marked successful does not prove that the business service can be restored.
Record evidence, assessment date, owner, current exposure, and the confidence in your conclusion. A lack of evidence should trigger investigation or a stated limitation, not an automatic low-risk rating. Reassess when important assumptions change.
Separate threats, weaknesses, and current exposure
A threat event describes something that could act on the service; a vulnerability or control deficiency describes a condition that may enable harm. Use service context, current threat information, and control evidence to judge their relevance. A campaign against a technology the organization does not use has a different immediate relevance from observed misuse of its own support accounts.
State whether the assessment describes exposure before a response, exposure with current safeguards, or expected exposure after planned treatment. Organizations use different conventions for inherent and residual risk, so record the convention and assumptions. Do not report a proposed safeguard as already effective.
Work through a scenario
A scanner reports a severe flaw on an ordering server. What additional information helps the manager prioritize the response?
Compare your reasoning
Establish exposure, evidence of exploitation, affected business processes, existing safeguards, feasible response options, and the impact of delay. Use the incident process immediately if active compromise is suspected.
A technical severity score is an input. It does not by itself describe business exposure or justify postponing an urgent response.
Worked exercise: Build a risk assessment worksheet
Fictional facts for learning. These assumptions and thresholds apply only to this exercise. Try the tasks before opening the worked solution.
- Service
- Online ordering depends on a supplier-managed support account.
- New information
- A newly reported campaign targets exposed supplier credentials; applicability has not yet been established.
- Evidence
- The account has broad access. A policy requires monthly review, but only one review record is available for the last six months.
Your task
- Write the risk scenario and name missing evidence.
- Decide what should trigger escalation or reassessment.
Show worked solution
- A compromised supplier account could permit unauthorized order changes or interrupt ordering. The campaign is a reason to investigate, not proof that this service is compromised.
- Confirm account exposure, authentication controls, actual permissions, recent activity, review scope, and business impact. The single record does not demonstrate six months of effective review. Record the service owner, assessment date, evidence sources, assumptions, and confidence.
- Escalate suspected active compromise through incident procedures. Reassess when campaign applicability, access scope, or safeguards change. Do not invent a numerical likelihood from the available facts; a defensible rating needs defined criteria and more evidence.
This exercise is not scored and does not contribute to an exam-readiness result.
Applied study · Added 2026-10-22
Use estimates without disguising uncertainty
Continue beyond the introduction. Work through the evidence before opening the model answer.
See it · Try it · Recall it
Picture the topic
Remember this: A threat matters through a path to a business consequence.
Explore the anchors
Detect technology business or threat changes.
Concept matching activity
Match this task or description to its concept:
Identify reachable assets and dependencies.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
Visual recap for topic 2A1. Open its full syllabus chapter.
Describe the event before computing the score
A useful risk statement links a credible event and weakness to an asset or service consequence. Distinguish inherent exposure from exposure after controls, and record which controls were actually tested. A numeric estimate should state its population, time horizon and evidence. Multiplying ordinal labels can create apparent precision without a defensible economic meaning; explain the method rather than treating every risk score as money.
Use loss estimates as decision aids
For a simplified annualized example, expected annual loss is estimated loss per event multiplied by estimated event frequency per year. This does not predict the exact next loss or describe every extreme outcome. Sensitivity analysis asks how the decision changes across plausible inputs. Include uncertainty, correlated events and consequences that are difficult to price. Avoid ranking a potentially catastrophic service failure solely by an average-loss calculation.
Evidence case
Fictional facts for learning; no real organization or person is described.
- A fictional service estimates loss per event at 200,000 units and frequency at 0.2 events per year.
- The estimates are based on limited data and exclude reputational consequences.
Your task
- Calculate the simplified annual expected loss.
- State two limits of the number.
Compare with the model answer
The simplified expected annual loss is 40,000 units. It is an estimate across a stated period, not a guaranteed annual bill or a maximum loss. Frequency uncertainty and excluded consequences may change the decision. Compare plausible input ranges and examine severe outcomes before proposing a response.
This case has two original scenario questions in the expanded practice bank. Practice this course · Edition, coverage and remaining study
Key terms
- Risk scenario
- A description connecting an event and relevant conditions to consequences.
- Uncertainty
- A limitation in knowledge about the assessment inputs or outcomes.
Remember
- Describe consequences for a specific service.
- Check operating evidence.
- Record uncertainty and reassessment triggers.
Check your understanding
Why might two systems with the same flaw receive different priorities?
Show explanation
Their exposure, safeguards, dependencies, business impact, and evidence of exploitation may differ.
Further reading
Examples and explanations are original learning material. These links provide background guidance; they do not certify exam coverage.
Found something unclear or inaccurate? Report a content correction.