Managing Risk in Information Systems, 3rd Edition

Understanding Risk Assessments

A risk assessment, also referred to as a risk analysis, is a process used to identify and evaluate risks. Risks are then quantified based on their importance or impact severity. These risks are then prioritized.

Risk assessments are a major part of an overall risk management program. They help identify which risks are most important. A major difference between a risk assessment and a risk management program is that the risk assessment is created for a moment in time, whereas a risk management program is a continuous process.

A risk assessment helps identify which safeguards to implement. Safeguards are also known as controls. They are used to control or reduce risk. A control may reduce a vulnerability or reduce ...