Every organization faces its share of risks, some that are under management's control and others that are unpredictable. Risk management involves identifying, analyzing and action taken to reduce or eliminate exposures to loss. Risk assessment is the first process in a risk management system, used to determine the extent of potential threats so appropriate controls may be identified.
There are several techniques for gathering information regarding vulnerability to risk, including on-site interviews, document review, and even automated scanning tools. An efficient and effective tool for analyzing relevant management and operational controls is to create a test. A questionnaire can be developed by risk assessment personnel and distributed to the applicable management who are designing or supporting the relevant systems.
Organizations particularly benefit from testing in situations where employee error is associated with serious financial, health or safety consequences. The primary principle of assessment is that it must be used purposefully, with a clear understanding of what needs to be measured and why. There are several types of risk that testing can measure, including strategic management, procurement, human resources, project management integration, and increasingly IT security. Without an accurate estimation of risk, you are likely to be either overspending or underspending on protecting business assets, or even protecting the wrong things altogether.
A systematic method for risk evaluation measures threat, vulnerability and cost on the same numeric scale so that a value can be assigned to the risk. Threat is the probability of a certain scenario occurring, vulnerability is the current state of susceptibility to the threat, and cost is the estimated resulting cost of one of these bad outcomes. The latter should include intangible costs such as business reputation and customer confidence. Due to the subjective nature of these evaluations, it is best practice to survey a cross-section of personnel from across a business.
The first step to effective risk assessment is to gather information about all types of possible risks that could apply to an organization, including incentives, pressures and opportunities of human threats. Begin by listing all identified risk elements and eliminating irrelevant issues that can't be planned for or mitigated. A test maker could ask participants to assess the likelihood, significance, existing control effectiveness, and residual vulnerability of a list of identified risks according to a quantifiable scale. One method is to assign a high and low range to the impact of each possible threat in a multiple choice test.
Once the likelihood of each element occurring and the resulting impact has been compiled, the two variables can be multiplied to determine and rank the risks. With a rating assigned to the overall risk, management becomes better positioned to determine the ideal mitigating controls to implement. Applying computer-based assessment from test creation software is the most efficient method of acquiring a wide range of data and developing a database of historical data to regularly update the process.
