Risk

## What Exactly Is Risk?

Risk = Likelihood × Impact

That's it. Everything in Domain 1 revolves around this simple but powerful formula. The (ISC)² defines risk as:

> "The potential that a given threat will exploit vulnerabilities of an asset or group of assets and thereby cause harm to the organization."

## The Risk Management Process (2025 Edition)

1. **Risk Identification** – What can go wrong?
2. **Risk Analysis** – How likely? How bad?
3. **Risk Evaluation** – Does it exceed our risk appetite?
4. **Risk Treatment** – Avoid, Mitigate, Transfer, or Accept?
5. **Risk Monitoring** – Is our treatment still effective?

## Qualitative vs Quantitative Risk Analysis

| Method | Pros | Cons | Best For |
|---------------|-------------------------------|------------------------------|-----------------------------|
| Qualitative | Fast, no complex math | Subjective | Initial screening |
| Quantitative | Dollar-based, objective | Requires good data | Business case justification |

Real-world tip: Most organizations use **hybrid** approaches — qualitative for daily operations, quantitative for board-level reporting.