Risk Management
# Risk management is the process for identifying, assessing, and mitigation vulnerabilities and threats to the essential functions that a business must perform to serve its customers
There are 5 main phases to risk management:
- Identify mission-essential functions
- Identify vulnerabilities
- Identify threats
- Analyze business impacts
- Identify risk response
Both Likelihood and Impact must be assessed.
Because risk management is so complex, it’s treated differently in companies of different sizes and with different regulatory and compliance requirements. Thus, most companies implement some for of Enterprise Risk Management policies and procedures. These legislative and framework compliance requirements are often formalized as a Risk and Control Self-Assessment. These RCSAs may be lead either by the organization implementing them, or by an external party. In the case of an external party, it is simply referred to as a Risk and Control Assessment.