# How to conduct a cyber risk assessment > Source: https://lscs.io/learn/grc/how-to-conduct-a-cyber-risk-assessment/ > A practical walkthrough of a cyber risk assessment — scoping, gathering information, analysing and scoring risk, agreeing treatment, and recording the outcome. A risk assessment is the point where GRC theory becomes a concrete piece of work with a deliverable. Done well it produces decisions; done badly it produces a document nobody reads. The difference is usually scoping and engagement rather than analytical sophistication. Video: https://www.youtube.com/watch?v=J2-PmqpdM_s ## What this session covers - Scope first and narrowly. 'Assess the organisation' produces nothing useful; 'assess the payment process' produces decisions. - Gather information from people who do the work, not only from documentation — the two often disagree, and the gap is itself a finding. - Score consistently using your defined scales, and record the reasoning, not just the number. - Agree treatment with the risk owner in the room. A treatment plan assigned to someone who was not consulted rarely happens. - Record the outcome in the risk register with an owner and a review date. The most common failure is producing a long list of findings with no named owners and no dates. That is an observation exercise, not a risk assessment. The second most common is assessing against a framework rather than against the business. A control gap only matters to the extent it exposes something the organisation cares about, and the assessment should make that connection explicit. ## Go further with mentorship This session is part of our free twelve-week GRC series. If you want structured, mentor-led support to turn this into a job-ready skill set, the LSCS GRC Mentorship programme runs over six months with live sessions, real case studies and interview preparation. [See the GRC Mentorship programme](https://lscs.io/grc-mentorship-course-details/)