Risk Assessment · Topic 4 of 6
Risk Assessment Concepts, Standards, Inherent and Residual Risk
CRISC risk assessment concepts: likelihood and impact, ISO 31000, ISO/IEC 27005 and NIST SP 800-30 processes, and inherent versus residual risk.
- 5 min
- Includes a diagram
- Risk combines likelihood and impact against agreed criteria.
- ISO 31000 assessment is identification, analysis and evaluation.
- ISO/IEC 27005:2022 allows event-based and asset-based identification.
What it is
A risk assessment identifies, analyses and evaluates risk so management can decide what to do about it. At its core, risk combines the likelihood that an event will happen with the impact if it does.
Inherent risk is the risk before any controls are considered. Residual risk is the risk that remains after controls are applied. The difference between them shows how much the controls are worth, and residual risk is what gets compared with appetite.
How it works
Core concepts
| Term | Meaning |
|---|---|
| Likelihood | Chance or frequency of the event, considering threat and vulnerability |
| Impact | Consequence to objectives: financial, operational, legal, reputational, safety |
| Risk criteria | Agreed scales and thresholds used to rate and evaluate risk |
| Risk rating | Result of combining likelihood and impact on the agreed scale |
| Exposure | The degree to which an asset is open to a threat |
Using the same criteria across the organization is essential. Ratings from different teams cannot be compared or aggregated if each team uses its own scale.
The main standards
| Standard | Assessment approach |
|---|---|
| ISO 31000:2018 | Risk assessment is identification, analysis and evaluation, set within scope, context and criteria |
| ISO/IEC 27005:2022 | Information security risk; identification can be event-based (from scenarios and sources) or asset-based (from assets, threats and vulnerabilities) |
| NIST SP 800-30 Rev 1 | Four steps: prepare for the assessment, conduct it, communicate results, maintain it |
| ISACA Risk IT | Risk evaluation using scenarios, aligned with COBIT 2019 |
NIST SP 800-30 Rev 1 also applies at the three NIST tiers: organization, mission and business process, and information system.
Scope and context
Before assessing, the practitioner agrees the scope (which processes, systems and sites), the context (business objectives, regulation, stakeholders) and the criteria. Skipping this step leads to assessments that answer the wrong question. This is why "define scope and objectives" is a common FIRST answer.
Assessment frequency
Assessments are repeated on a schedule and when triggers occur: major changes to systems or processes, new regulation, significant incidents, mergers, new suppliers or a changed threat landscape.
Inherent, residual and target risk
| Term | Meaning |
|---|---|
| Inherent risk | Risk with no controls considered |
| Current or residual risk | Risk after existing controls, as they actually operate |
| Target risk | The level management wants to reach after planned treatment |
Residual risk depends on how controls actually perform, not how they are designed on paper. If a control is designed well but operating poorly, residual risk is higher than the design suggests. Control testing (Risk Response and Reporting chapter) gives the evidence.
Residual risk is compared with appetite and tolerance. If it is within appetite, the risk owner can accept it. If not, further treatment or escalation is needed.
Inherent risk helps show which controls are most important, because a high inherent risk with low residual risk means the control is doing heavy lifting and must be monitored closely.
A worked example
An online bank assesses the risk of account takeover. With no controls, inherent risk is rated very high: likelihood high, impact high. Existing controls are multifactor authentication, fraud monitoring and login rate limiting.
Testing shows MFA is enforced for 98% of customers, but a legacy mobile app version still allows password-only login. Residual risk is therefore rated high, not low as the design suggested. Appetite for customer fraud is low, so the practitioner recommends retiring the legacy app version and presents the options to the head of digital banking, who owns the risk.
How the exam asks about this
- "What should the practitioner do FIRST when planning a risk assessment?" Define scope, context and criteria with the stakeholders.
- "Which risk level should be compared with risk appetite?" Residual risk, after existing controls.
- "A control is well designed but not operating effectively. What is the effect on risk?" Residual risk is higher than the design would indicate.
What to remember for the exam
- Risk combines likelihood and impact against agreed criteria.
- ISO 31000 assessment is identification, analysis and evaluation.
- ISO/IEC 27005:2022 allows event-based and asset-based identification.
- NIST SP 800-30 Rev 1 steps: prepare, conduct, communicate, maintain.
- Residual risk, based on how controls actually operate, is compared with appetite.
High inherent risk is not a reason to act by itself. Decisions depend on residual risk against appetite, so first find out how well the existing controls work.
Common mistakes
Measuring residual risk from control design alone. Only evidence of operation shows what risk really remains.
Using different scales in different teams. Ratings cannot be compared or aggregated into the enterprise profile.
Treating the assessment as a one-time project. Change, incidents and new threats all require reassessment.
Check yourself
What is the difference between inherent and residual risk?
Inherent risk is the risk before controls are considered; residual risk is what remains after existing controls are applied as they actually operate.
What are the two ways ISO/IEC 27005:2022 describes for identifying risk?
An event-based approach starting from risk sources and scenarios, and an asset-based approach starting from assets, threats and vulnerabilities.
Why must scope and criteria be agreed before an assessment?
Without them, the assessment may cover the wrong area and produce ratings that cannot be compared or used for decisions.
Topic 4 of 6 in Risk Assessment
Test yourself on Risk Assessment
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.