What it means
Risk connects a possible event to a consequence that matters. A useful statement says what could happen, which weakness or condition makes it possible, and who would be harmed. The assessment then considers likelihood, impact, existing controls, and uncertainty. This makes a risk actionable instead of a vague concern such as “hackers.”
Risk exists before anyone writes it down. A risk register is the record used to make decisions about it. Different teams may use qualitative categories or quantitative estimates, but the assumptions still need to be visible. The purpose is to choose and track a response, not merely produce a score.
AN ILLUSTRATIVE SCENARIO
A retailer payment export
A retailer lets every store supervisor download all stores' payment reconciliation records. The concern is that a stolen supervisor account could expose information beyond that person's job. The team records the broad permission as a weakness, account theft as a possible event, and the resulting disclosure and response effort as consequences. It proposes limiting exports by store, names an owner, and sets a review date. Management can then compare the remaining exposure with the cost and disruption of changing access.
Put it to work
- Write one clear scenario connecting an asset, an unwanted event, relevant weaknesses, and a concrete consequence.
- Assess likelihood and impact using available evidence; document operating controls, assumptions, and important information you still lack.
- Assign an accountable owner to choose a response, track actions and deadlines, and revisit the assessment after meaningful changes.
How to check your work
Inspect one risk record. It should support a real decision, identify who owns that decision, and show when evidence or a changed condition will trigger another review.
Connect the ideas
- Threat
A person, process, or event that might cause a loss to an asset.
- Vulnerability
A weakness in a system, process, or person that makes a loss easier to cause.
- Likelihood
How plausible it is that a threat will cause a loss in this environment, given exposure and evidence.
- Residual risk
The risk that remains after selected controls, including the uncertainty you still accept.