5.1 Risk Analysis: Assessing Likelihood, Consequence, and Controls

5.1 Risk Analysis: Assessing Likelihood, Consequence, and Controls

Under ISO 31000:2018, Risk Analysis represents the fourth core step of the risk management process. Having identified risk events, sources, and potential impacts during the identification phase, the risk practitioner must analyze the risk to gain a comprehensive understanding of its nature, characteristics, and level. The primary objective of risk analysis is to provide a detailed, objective input for Risk Evaluation (Process Step 5) and to inform subsequent decisions regarding whether risk treatment is required and which treatment strategies will be most effective.

Risk analysis involves a detailed consideration of the sources of risk, their positive and negative consequences, the likelihood that those consequences will occur, the factors that drive likelihood and impact, and the existence and effectiveness of existing controls.

---

Understanding Likelihood and Consequence Scales

Risk levels are fundamentally determined by combining the estimated likelihood of a risk event with its potential consequences across defined organizational objectives.

Likelihood Assessment

Likelihood is defined in ISO 31000 as the chance of something happening. It can be defined, measured, or determined objectively or subjectively, qualitatively or quantitatively, and described using general terms or mathematically (such as probability or frequency over a given time period).

1. Frequency: The expected number of occurrences of an event per unit of time (e.g., 2 equipment failures per decade, or 12 cyber phishing attempts per month).
2. Probability: A mathematical measure of the degree of certainty that an event will occur within a specified time horizon, expressed as a number between 0 (impossible) and 1 (certainty), or as a percentage from 0% to 100%.
3. Qualitative Descriptors: Ordinal categories used when precise empirical data is unavailable (e.g., Rare, Unlikely, Possible, Likely, Almost Certain).

Consequence Assessment

Consequence is defined as the outcome of an event affecting objectives. A single event can lead to an array of multiple consequences of varying magnitudes. Consequences can be certain or uncertain, positive or negative, direct or indirect.

When designing consequence scales, organizations must establish clear boundaries across multiple impact dimensions:

• Financial Impact: Direct monetary loss, unbudgeted expenditure, or revenue loss.
• Operational Impact: Disruption duration, service outage length, or percentage loss of operational capacity.
• Reputational Impact: Media coverage intensity, customer churn rate, or brand equity impairment.
• Regulatory/Legal Impact: Statutory fines, regulatory sanctions, license revocation, or criminal prosecution.
• Health and Safety Impact: Minor injuries, lost-time injuries, permanent disability, or fatalities.

---

Qualitative vs. Semi-Quantitative vs. Quantitative Analysis

ISO 31000 and IEC 31010:2019 recognize three primary analytical approaches. The selection of an approach depends on the purpose of the assessment, data availability, organizational context, resources, and decision complexity.

Semi-Quantitative Ordinal Pitfall (Exam Critical)

A frequent trap on the PECB ISO 31000 Risk Manager exam concerns mathematical operations on semi-quantitative ordinal scales. In semi-quantitative scoring, ordinal numbers (e.g., Likelihood Rank 1 to 5, Consequence Rank 1 to 5) are assigned to qualitative categories.

Multiplying ordinal ranks directly (e.g., $3 \times 4 = 12$) assumes that the distance between Rank 1 and Rank 2 is identical to the distance between Rank 4 and Rank 5. In reality, a Consequence score of 5 (e.g., $10,000,000 loss) may be 1,000 times greater than a Consequence score of 1 (e.g., $10,000 loss). Multiplying ordinal numbers creates distorted risk ranks unless non-linear, mathematically calibrated scoring matrices are implemented.

---

Evaluating Control Design and Operating Effectiveness

A control is defined by ISO 31000 as any measure that maintains and/or modifies risk. Controls include policies, procedures, physical barriers, automated system validation rules, governance oversight committees, and backup redundancies. Analyzing risk requires a thorough evaluation of existing controls across two distinct dimensions:

1. Control Design Effectiveness (CDE)

Control Design Effectiveness evaluates whether the control, as designed and documented, is conceptually capable of preventing, detecting, or mitigating the risk event to an acceptable level.

• Key Question: If this control operates exactly as specified on paper, will it successfully reduce the likelihood or consequence of the risk?
• Failure Mode: Inadequate design occurs when a control addresses the wrong root cause or lacks the capability to withstand peak risk exposure.

2. Control Operating Effectiveness (COE)

Control Operating Effectiveness evaluates whether the control operates consistently, reliably, and continuously in practice as intended over time.

• Key Question: Is the control actually executed correctly by trained staff or automated systems every single time it is triggered?
• Failure Mode: Operating failure occurs when human error, lack of training, override by management, or technical system outages prevent a well-designed control from executing.

Control Typology Framework

• Preventive Controls: Act before the risk event occurs to decrease likelihood (e.g., dual-authorization rules, firewalls, mandatory safety training).
• Detective Controls: Identify the occurrence or emergence of a risk event in real-time or post-facto (e.g., intruder alarms, automated reconciliation checks, periodic audits).
• Corrective Controls: Act after a risk event or detection to restore normal operations and mitigate consequences (e.g., business continuity plans, disaster recovery sites, emergency response teams).
• Directive Controls: Establish policies, standards, and behavioral guidelines to guide risk-aware action (e.g., code of conduct, risk management policy).

---

Worked Calculation Example: Quantitative Loss Expectancy Analysis

To illustrate quantitative risk analysis, consider an enterprise evaluating a potential data breach risk affecting its customer database.

Baseline Parameters

• Asset Value (AV): Total monetary value of customer records database = $5,000,000
• Exposure Factor (EF): Percentage of asset value lost during a single successful breach = 30% (0.30)
• Annualized Rate of Occurrence (ARO): Estimated frequency of breach attempts succeeding per year without additional controls = 0.40 (once every 2.5 years)

Mathematical Formulation

1. Single Loss Expectancy (SLE): $\text{SLE} = \text{AV} \times \text{EF} = \$5,000,000 \times 0.30 = \$1,500,000$

2. Baseline Annualized Loss Expectancy (ALE): $\text{ALE}_{\text{baseline}} = \text{SLE} \times \text{ARO}_{\text{baseline}} = \$1,500,000 \times 0.40 = \$600,000$

Evaluating Impact of Control Implementation

The enterprise deploys Multi-Factor Authentication (MFA) and automated Intrusion Prevention Systems (IPS).

• The technical evaluation confirms Control Design Effectiveness (CDE) reduces breach probability, dropping ARO from 0.40 to 0.05 (once every 20 years).
• The automated encryption control improves Control Operating Effectiveness (COE), reducing data exposure if breached, dropping EF from 30% to 10% (0.10).

1. Post-Control Single Loss Expectancy (SLE): $\text{SLE}_{\text{controlled}} = \$5,000,000 \times 0.10 = \$500,000$

2. Post-Control Annualized Loss Expectancy (ALE): $\text{ALE}_{\text{controlled}} = \text{SLE}_{\text{controlled}} \times \text{ARO}_{\text{controlled}} = \$500,000 \times 0.05 = \$25,000$

3. Net Annualized Loss Reduction: $\text{Net Exposure Reduction} = \text{ALE}_{\text{baseline}} - \text{ALE}_{\text{controlled}} = \$600,000 - \$25,000 = \$575,000$