thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Foundational

Risk Assessment

Overall process of risk identification, risk analysis, and risk evaluation.

Definition

Per ISO 31000 and ISO/IEC 27005, risk assessment comprises identifying risks, analyzing their likelihood and consequences, and evaluating them against risk criteria to decide priorities for treatment. NIST SP 800-30 describes a similar process: prepare, conduct, communicate, and maintain. Risk assessments should be repeated periodically and when significant changes occur.

Example

An annual enterprise risk assessment identifies 45 risks, rates them, and selects 12 for treatment.

Exam tip

Know the order: identification, analysis, evaluation, then treatment.

Related terms