Cyber risk management: an introduction
Risk management is the engine of GRC. It is the process by which an organisation works out what could go wrong, how much that would matter, and what — if anything — it intends to do about it. Everything else in GRC either feeds this process or reports on its output.
What this session covers
- Identification: finding the things that could plausibly go wrong, from assets, threats, processes and third parties.
- Analysis: judging likelihood and impact, whether qualitatively (high/medium/low) or quantitatively (in money).
- Evaluation: comparing the result against the organisation's stated appetite to decide whether it is tolerable.
- Treatment: choosing to mitigate, transfer, avoid or accept — and recording who made the decision.
The four treatment options are worth internalising early, because almost every risk conversation resolves into one of them. Mitigate means reducing likelihood or impact with a control. Transfer means moving the financial consequence elsewhere, usually through insurance or a contract. Avoid means not doing the risky thing at all. Accept means deciding, consciously and on the record, to live with it.
Acceptance is the one people get wrong most often. An accepted risk is not an ignored risk — it needs a named owner, a documented rationale and a review date. Risk that is simply never discussed is not accepted; it is unmanaged.
Go further with mentorship
This session is part of our free twelve-week GRC series. If you want structured, mentor-led support to turn this into a job-ready skill set, the LSCS GRC Mentorship programme runs over six months with live sessions, real case studies and interview preparation.