Module 17: Risk Assessment Concepts, Standards & Frameworks

Identification tells you what could happen.
Assessment tells you how much it matters.

This module shifts from describing risk to evaluating it.

CRISC expects you to understand:

• How likelihood is estimated
• How impact is measured
• How inherent and residual risk differ
• How risk is evaluated against appetite
• Why structured frameworks matter

What the exam is really testing

When risk assessment appears, CRISC is asking:

• Is risk measured consistently?
• Is impact evaluated in business terms?
• Is likelihood reasonably estimated?
• Is risk evaluated against appetite?
• Is a formal framework being used?

CRISC prefers structured methodology over intuition.

Core risk assessment concepts

You must be clean on these.

Likelihood

The probability that a risk event will occur.

It is influenced by:

• Threat frequency
• Vulnerability exposure
• Control effectiveness
• Environmental factors

Likelihood is not guesswork — it should be based on data, trends, or structured analysis.

Impact

The magnitude of consequence if the event occurs.

Impact can include:

• Financial loss
• Regulatory penalties
• Reputational damage
• Operational disruption
• Strategic delay

CRISC prioritizes business impact over technical severity.

Risk level

Commonly expressed as:

Likelihood × Impact

Not always numerical, but conceptually:

Higher likelihood + Higher impact = Higher risk

Inherent vs residual risk

This distinction is heavily tested.

Inherent risk

The level of risk before controls are applied.

This represents raw exposure.

Residual risk

The level of risk after controls are implemented.

This represents remaining exposure.

If residual risk exceeds appetite, escalation or mitigation is required.

The most common exam mistake

Candidates often:

• Confuse inherent and residual risk
• Assume controls eliminate risk entirely
• Focus only on impact
• Ignore likelihood drivers
• Forget evaluation against appetite

CRISC evaluates risk in context.

Qualitative vs quantitative assessment

CRISC expects you to understand both approaches conceptually.

Qualitative assessment

Uses categories like:

• High / Medium / Low
• Critical / Moderate / Minor

Pros:

• Faster
• Easier to communicate

Cons:

• Less precise
• Subjective

Quantitative assessment

Uses numerical values:

• Monetary loss estimates
• Probability percentages
• Annualized loss expectancy (ALE)

Pros:

• More precise
• Better financial alignment

Cons:

• Requires reliable data

CRISC does not require heavy math — but you must understand the concept.

Risk evaluation

Assessment measures risk.

Evaluation compares risk against:

• Risk appetite
• Risk tolerance
• Regulatory thresholds
• Strategic objectives

Assessment without evaluation is incomplete.

CRISC frequently tests escalation when risk exceeds tolerance.

Standards and frameworks

CRISC does not test framework memorization.

But it expects you to recognize that risk assessment should be:

• Formalized
• Repeatable
• Documented
• Aligned with ERM

Examples (conceptually, not for memorization):

• Enterprise risk frameworks
• Industry standards
• Organizational methodology

If departments assess risk differently, governance maturity is low.

Example scenario (walk through it)

Scenario:
A risk assessment identifies a high-impact risk. After implementing compensating controls, the remaining exposure is moderate and within defined tolerance thresholds.

What level of risk remains?

A. Inherent risk
B. Residual risk
C. Accepted risk
D. Aggregated risk

Correct answer:

B. Residual risk

Because controls have been applied.

Slightly harder scenario

An organization rates risks differently across departments, using inconsistent scoring criteria.

What is the MOST significant issue?

A. Poor asset classification
B. Lack of structured risk assessment framework
C. Weak control monitoring
D. Excessive risk appetite

Correct answer:

B. Lack of structured risk assessment framework

Consistency is required for meaningful comparison and aggregation.

Likelihood trap scenario

A rare but catastrophic risk event is identified.

Which factor should MOST influence prioritization?

A. Likelihood only
B. Impact only
C. Combined evaluation of likelihood and impact
D. Industry benchmarks

Correct answer:

C. Combined evaluation of likelihood and impact

Risk level depends on both components.

Risk acceptance and escalation

If residual risk exceeds tolerance:

• Escalation is required
• Formal acceptance must be documented
• Leadership must evaluate against appetite

CRISC prefers structured decision-making.

Quick knowledge check

1) What is residual risk?

A. Risk before controls
B. Risk after controls
C. Risk accepted by management
D. Aggregated enterprise risk

2) Which factor most directly influences likelihood?

A. Regulatory penalties
B. Asset classification
C. Threat frequency and vulnerability exposure
D. Reputational damage

3) A risk remains above tolerance after mitigation. What should occur?

A. Ignore if impact is low
B. Escalate for formal evaluation
C. Reduce reporting frequency
D. Reclassify the asset

Final takeaway

Risk assessment must be:

• Structured
• Consistent
• Business-aligned
• Compared against appetite
• Documented and repeatable

Inherent risk shows raw exposure.

Residual risk shows remaining exposure.

Assessment without evaluation is incomplete.

CRISC rewards candidates who think in disciplined, structured risk evaluation terms.