How do you evaluate the risk of different threats?

Threat identification is increasingly professionalized through the corporate intelligence function inside of GSOCs (Global Security Operations Centers). The best GSOCs are managed by experienced intelligence professionals, who are practiced not only at geostrategic and community specific threat identification - but also understand the business and industry. GSOCs require an investment in data feeds, analytics tools, case management software, visualization and equipment, law enforcement and business fusion functions, and in the right mix of staff. The right place for a GSOC is NOT in the basement next to the boiler - it is partnered with the business to ensure timely collection of threat data. The most effective GSOCs integrate cyber.

Threat identification can also be effectively done through process understanding reviews / walkthrough with process owners. It is an effective method of getting a firsthand practical and process level assessment of potential threats. Closely linked to this is identifying the root cause of the threats (which are usually embedded in the processes).

First step should be to frame the organisation or project objectives before conducting risk surveys or assessments. We need to ensure risks are related to the outcome of those objectives so any subsequent actions to address them will be effective in ensuring we achieve our intended outcomes and goals.

The goal of identifying a basket of risks in an organization is one thing but most important is to have dynamic and sustainable strategies of eliminating some of unsystematic risks completely so as to focus on a portable list.

Actually, I agree that risk management has become very complex and requires making decisions on the go as the risk and interventions are now very agile in emerging operational environments; a case reference the COVID-19 19. The risk identification models should therefore be built on flexibility, agility, resilience and sustainability to be able to address the risks and to guarantee and meet business objectives. Gone are the days of "10 years business strategy", that luxury does not exist anymore. Risk identification should therefore take the form of Scenario planning, Business Model Risk Reviews and process risk reviews in order to be responsive to the current and future threats to business, people and the environment.

There are three steps in risk management process: identifying, quantifying and mitigating the risks. Before identifying the risks global economic risks, local economic risks, sectoral risks and company spesific risks should be analysed in detail. After identfying the relevant risks, the risk itself should be quantified in order to understand the possible impacts when metarialized. Quantifying the risks is crutial. If the risk can not be quantified properly, the magnitude of the risk can not be judged. Scenario analysis can be performed at this stage. The last part of the process is mitigation. The identified and quantified risks should be mitigated - if any. The mitigation process must be quantifiable as it was in the prior stage.

You can use ten point scales, but for small businesses I suggest a grid approach with 3 measures on each axis, low, medium or high. This gives 9 points from low impact and likelihood to high. Low/low (1) can be accepted, and high/high (9) needs to be mitigated at a minimum or eliminated. Business consultants like myself can give you a framework to work with and help you assess your risks.

This is the most challenging part - understanding the likelihood of the risk to happen and the impact it can have on a business. Whatever the case is, it should not be an exercise on paper but a practical task which leads to action.

You can take into consideration existing controls within the business to determine the likelihood of occurrence. This will help to make the exercise less theoretical.

Before assigning likelihood and impact, we need to fully identify the causes and impacts and reach an in-depth understanding of the risk. The bow-tie methodology is brilliant for doing that because it helps us understand the path of the risk. Once we have listed all causes and consequences we can assign likelihood and impact with much more confidence.

In anti-money laundering (AML) compliance, this is an important step of the risk assessment. We call it "the risk-based approach" - a requirement to identify, understand and take appropriate measures to mitigate your money laundering and terrorist financing (ML/TF) risks. The purpose is to enable a company to focus on areas where the risks are higher and invest more resources, including people and controls to effectively mitigate the risks identified.

Absolutely. In my years of experience, understanding threats is just half the battle. Prioritizing them is where strategic decision-making comes into play. Using tools like risk maps or heat charts provides a visual snapshot, allowing me to swiftly pinpoint the most pressing threats. It's crucial to categorize these into distinct levels, ensuring resources are directed towards the most critical risks. My mantra: know them, rank them, and tackle them methodically.

Coming from managing Risk as a Commando to now managing it for J.P. Morgan’s Private Bank in Investment Operations, I’ve had two very different perspectives. Also two very different types of Risk. One involved serious threat or indeed, death and the other huge potential for financial loss or Firm reputation damage. Heat maps, risk tables and charts are tools. They can be powerful, but the human aspect always takes precedence - the capacity to interpret nuance and atmospherics that data simply cannot do. The categorisation of Risk it’s essential for governance and communicating the severity of what we’re dealing with.

Prioritization of threats is an ongoing process as most threat profiles change over time. Its critical not to have a "set and forget" mindset. It needs to be a proactive process across an organization so that all relevant stakeholders are engaged. Categorization of threats will be a function of the severity and likelihood of the threat at that moment in time.

This is where theoretical assessment morphs into practical action. It is at this point that management decides if the risk is within the business risk appetite and they can apply a variety of action plans including avoiding, mitigating, transferring or accepting the risks.

Success in managing the organization's risks needs a balance between processes, systems and people. People ultimately make the decisions that define whether risks are appropriately responded to. Therefore, the risk appetite of the organization and for various types of risks should be clearly communicated through the organization. The process for determining responses to specific risks needs to be clear and where possible, technology / systems should be used to automate some of the responses and identify any deviations from expected response actions.

Before thinking about the mitigations, you have to assess the controls you have in place to either prevent the risk from occurring or mitigate its consequences. All organisations deliver their product or service through people, processes, systems, and data. And many serve as controls. Before launching into mitigation planning, we have to understand our operating environment and determine what's working and what's not from a risk perspective. Then we can determine if we need to do anything else.

“War gaming” or table top exercises can be useful at this stage to bring all stakeholders together to understand their roles at every stage and identify potential problems.

One technique I found useful is to have a multi-criteria approach to evaluating responses. And, the evaluation of possible responses will depend on the severity of the threat. Prioritize those that are high risk based on your organizations risk appetite and those almost always require collective input across an organization to evaluate responses.

In my seasoned experience, implementation and monitoring are akin to steering a ship through turbulent waters. Execution is crucial, but without vigilant monitoring, even the best strategies can drift off course. Using dynamic tools, like real-time dashboards, can offer insights not just into what's being done, but also how effectively it's being achieved. The ultimate aim isn't just to reduce risk but to transform it into opportunity. With every review and iteration, we're not just sidestepping pitfalls, but we're pivoting towards innovation.

This is where AI and Automated solutions can provide huge sways of value. KPIs and clear risk metrics allow for a clear picture or “process health”. In other words having a meaningful measure of your process/projects risk profile, regularly updated can alert your risk managers to the need for evaluation. Are we breaching a certain metric? Why? Have we never breached on others at all? Yet we know there is process difficulties? All require the human touch to evaluate!

The successful implementation of any process or system requires the buy-in of all relevant stakeholders, especially those that are assigned as owners of that risk. Again, the tools are relatively well established but how well those tools are used is often variable. Risk management should be incorporated into every team/business unit/corporate meeting as a standing agenda item so that it is front and center of an organizations activities. Monthly enterprise wide risk workshops should be held to ensure the threat/risk profiles are updated and new ones incorporated. Identification of risks should be incorporated as a KPI for all employees of an organization.

Threats to organizations are often not tracked or systematically organized for easy retrieval and review. For example, would your organization be able to easily pull threatening or troubling communications from an email address to see if the language and tone are changing?

The headline needs to change. Identifying risk is all through identifying threats to your business outcomes. If you start assessing the risk level of a threat during identification stages of risk management, you will put your team off it completely.

Understanding the organization and its business - crucial for any threats and risks assessment. And also good old common sense.

Governance is also important to add for consideration. Some risks require escalation to management, leadership and the Board to be addressed appropriately and effectively. Also, assurance should be put in place for enauring that risk management is working effectively. Risk assurance can take the form of self assurance, peer or SME reviews and audits.

Risk evaluation of any threat is done through an Impact versus likelihood assessment; an inherent risk is then derived. After applying mitigation techniques and putting controls in place, a residual risk is derived based on which the final decision, either to take or terminate the risk, is taken. Residual risk must be always assessed based on the organisation risk appetite and risk tolerance.

Evaluating the risk of different threats involves identifying potential threats (e.g., natural, human-induced, technological), assessing system vulnerabilities, estimating the likelihood of each threat based on historical data and expert judgment, and evaluating the potential impact in terms of financial loss, operational disruption, or reputational damage. Risks are calculated by combining likelihood and impact, often visualized in a risk matrix, and then prioritized to focus on high-likelihood, high-impact threats. Mitigation strategies are developed for high-priority risks, and the process is continuously monitored and reviewed to adapt to changes in the environment and ensure the effectiveness of the mitigation measures.