Risk Assessment · Topic 6 of 6
Risk Analysis Methodologies and the Risk Register
CRISC risk analysis: qualitative, semi-quantitative and quantitative methods, ALE and FAIR, other techniques, and what a good risk register entry contains.
- 5 min
- Qualitative is quick but subjective; quantitative needs data but supports cost-benefit.
- SLE = asset value x exposure factor; ALE = SLE x ARO.
- FAIR splits risk into loss event frequency and loss magnitude.
What it is
A risk analysis methodology is the method used to turn a risk scenario into a rating. Methods range from qualitative (high, medium, low) to quantitative (money and probabilities), with semi-quantitative scoring in between.
The risk register is the record of identified risks, their ratings, owners, responses and status. The job practice asks the practitioner to maintain the IT risk register and incorporate it into the enterprise risk profile.
How it works
Comparing the main approaches
| Approach | How it rates | Strengths | Weaknesses |
|---|---|---|---|
| Qualitative | Descriptive scales such as low, medium, high | Quick, easy to understand, works without data | Subjective; hard to compare or add up |
| Semi-quantitative | Numbers assigned to scales, for example 1 to 5, then multiplied | Allows ranking and heat maps | Numbers look precise but are still judgements |
| Quantitative | Money values and probabilities | Supports cost-benefit decisions and comparison with financial risks | Needs reliable data, time and skill |
The BEST method is the one that fits the decision, the data available and the audience. Many organizations start qualitative and use quantitative analysis for their largest risks.
Classic quantitative formulas
| Term | Formula |
|---|---|
| Single loss expectancy (SLE) | Asset value x exposure factor |
| Annualized rate of occurrence (ARO) | Expected number of events per year |
| Annualized loss expectancy (ALE) | SLE x ARO |
Example: a server farm worth 500,000 with an exposure factor of 40% gives an SLE of 200,000. If the event is expected once every four years, the ARO is 0.25 and the ALE is 50,000. A control costing 20,000 a year that cuts the ARO to 0.05 lowers the ALE to 10,000, a saving of 40,000 for a cost of 20,000.
FAIR
Factor Analysis of Information Risk (FAIR), published by The Open Group as Open FAIR, breaks risk into loss event frequency and loss magnitude. Loss event frequency comes from threat event frequency and vulnerability (the probability a threat event becomes a loss). Analysts use ranges and Monte Carlo simulation to produce a distribution of possible annual losses rather than a single number.
Other techniques
| Technique | Use |
|---|---|
| Bow tie analysis | Shows causes and preventive controls on one side, consequences and recovery controls on the other |
| Fault tree analysis | Works backwards from an event to its combinations of causes |
| Event tree analysis | Works forwards from an event to possible outcomes |
| Delphi technique | Anonymous expert rounds that converge on an estimate |
| Scenario workshops | Owners and specialists rate scenarios together |
The risk register
A useful register entry holds:
| Field | Example |
|---|---|
| Risk ID and title | R-042 Ransomware on order system |
| Scenario | Actor, event, asset, impact |
| Category | Operational, technology |
| Risk owner | Head of operations |
| Inherent and residual rating | Very high, then high |
| Existing controls | Backups, EDR, MFA |
| Response and action plan | Mitigate: offline backups by 31/03/2027 |
| KRIs | Backup success rate, patch backlog |
| Status and review date | Open, next review 01/02/2027 |
The register must be current. Ratings, owners and actions change, and stale entries mislead management.
Every risk needs an owner with authority. IT register entries should use the enterprise taxonomy and scales so they can feed the enterprise risk profile.
A worked example
A practitioner must help the board decide whether to buy a 300,000 data loss prevention platform. Qualitative ratings show the data breach risk as "high", but that does not show whether the spend is justified.
Using FAIR with breach data from the industry and the company's own incident history, the analysis estimates annual loss exposure with and without the platform. The reduction in expected loss is greater than the annual cost, which gives the board a financial basis for the decision. The result is recorded against the risk in the register.
How the exam asks about this
- "Which method is MOST appropriate when reliable data is scarce?" Qualitative analysis, using expert judgement and clear scales.
- "What is the PRIMARY benefit of quantitative risk analysis?" It supports cost-benefit decisions by expressing risk in financial terms.
- "What is the MOST important element of a risk register entry?" A clearly assigned risk owner with authority to manage the risk.
What to remember for the exam
- Qualitative is quick but subjective; quantitative needs data but supports cost-benefit.
- SLE = asset value x exposure factor; ALE = SLE x ARO.
- FAIR splits risk into loss event frequency and loss magnitude.
- A register entry needs a scenario, owner, ratings, controls, response, KRIs and review date.
- The IT register must roll up into the enterprise risk profile.
Semi-quantitative scores look precise but are still opinions. Multiplying a 4 by a 5 does not make 20 a measured value, so do not treat it as a financial estimate.
Common mistakes
Choosing quantitative analysis by default. Without reliable data it gives false precision.
Letting the register go stale. Old ratings and owners who have left the company make it misleading.
Leaving risks without owners. A risk with no owner will not be treated.
Check yourself
An asset worth 100,000 has an exposure factor of 25% and an ARO of 2. What is the ALE?
The SLE is 25,000, so the ALE is 25,000 x 2 = 50,000 per year.
When is qualitative analysis the BEST choice?
When data is limited, time is short, or the audience needs a quick relative ranking rather than financial figures.
What two factors does FAIR use to describe risk?
Loss event frequency and loss magnitude.
Topic 6 of 6 in Risk Assessment
Test yourself on Risk Assessment
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.