Title: Risk Management Discussion Points
Course: IN 2001 Principle of Information Assurance > Section: Module 4: Chapter Four

Risk Management Discussion Points
Not every organization has the collective will or budget to manage each vulnerability by applying controls; therefore, each organization must define the level of risk it is willing to live with.
Risk Appetite
1. Risk appetite defines the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility.
2. The key for an organization is to find the balance in its decision-making processes and in its feasibility analyses, therefore assuring that an organization’s risk appetite is based on experience and facts and not on ignorance or wishful thinking.

Residual Risk
1. Even when vulnerabilities have been controlled as much as possible, there is often still some risk that has not been completely removed, shifted, or planned for.  This remainder is called residual risk.
2. “Residual Risk is a combined function of (1) a threat less the effect of some threat reducing safeguards; (2) a vulnerability less the effect of some vulnerability reducing safeguards; and (3) an asset less the effect of some asset value reducing safeguards.”
3. The significance of residual risk must be judged within the context of the organization.  The goal of information security is not to bring residual risk to zero; it is to bring residual risk into line with an organization’s comfort zone or risk appetite.

Documenting Results
1. The results of risk assessment activities can be delivered in a number of ways: a report on a systematic approach to risk control, a project-based risk assessment or a topic-specific risk assessment.
2. When the organization is pursuing an overall risk management program, it requires a systematic report that enumerates the opportunities for controlling risk.  This report documents a series of proposed controls, each of which has been justified by one or more feasibility or rationalization approaches.
3. At a minimum, each information asset-vulnerability pair should have a documented control strategy that clearly identifies any residual risk remaining after the proposed strategy has been executed.
4. Another option is to document the outcome of the control strategy for each information asset-threat pair in an action plan.  This action plan includes concrete tasks, each with accountability assigned to an organizational unit or to an individual.
5. Sometimes a risk assessment is prepared for a specific IT project at the request of the project manager, either because it is required by organizational policy or because it is good project management practice. The project risk assessment should identify the sources of risk in the finished IT system, with suggestions for remedial controls, as well as those risks that might impede the completion of the project.
6. When management requires details about a specific risk to the organization, risk assessment may be documented in a topic-specific report.  These are usually demand reports that are prepared at the direction of senior management and are focused on a narrow area of information systems operational risk.