Understanding risk assessments

When assessing risk, there are typically two approaches; one approach involves qualitative techniques. The metrics used within this approach will include likelihood and impact and may include other metrics such as speed of onset. This is considered a basic form of risk assessment and will include background knowledge from the assessor. It is often considered a subjective method, meaning two different risk assessors may not agree exactly when delivering a qualitative risk assessment. A common approach to risk management is to break the process down into steps or phases. Figure 13.1 shows a five-step approach:

Figure 13.1 – Risk management steps

To understand risk, we must be able to quantify a level of risk as a measurement. In all cases, we will have assets that must be protected, so we then need to calculate the level of risk using likelihood and impact.

One of the accepted approaches to risk assessments is to use...