How to conduct a cyber risk assessment
A risk assessment is the point where GRC theory becomes a concrete piece of work with a deliverable. Done well it produces decisions; done badly it produces a document nobody reads. The difference is usually scoping and engagement rather than analytical sophistication.
What this session covers
- Scope first and narrowly. 'Assess the organisation' produces nothing useful; 'assess the payment process' produces decisions.
- Gather information from people who do the work, not only from documentation — the two often disagree, and the gap is itself a finding.
- Score consistently using your defined scales, and record the reasoning, not just the number.
- Agree treatment with the risk owner in the room. A treatment plan assigned to someone who was not consulted rarely happens.
- Record the outcome in the risk register with an owner and a review date.
The most common failure is producing a long list of findings with no named owners and no dates. That is an observation exercise, not a risk assessment.
The second most common is assessing against a framework rather than against the business. A control gap only matters to the extent it exposes something the organisation cares about, and the assessment should make that connection explicit.
Go further with mentorship
This session is part of our free twelve-week GRC series. If you want structured, mentor-led support to turn this into a job-ready skill set, the LSCS GRC Mentorship programme runs over six months with live sessions, real case studies and interview preparation.