Risk Assessment refers to the quantitative assessment of the impact and possibility of loss caused by a risk event on people's life, property and other aspects before or after the event (but not yet finished). From the perspective of information security, risk assessment refers to the assessment of the threats, existing weaknesses and impacts of information assets (i.e., the information set possessed by an event or thing), as well as the possibility of risks brought by the combined effects of the three. As the basis of risk management, risk assessment is an important way to determine the information security needs of the organization. It belongs to the process of organization information security management system planning. It is mostly used in the field of investment.
What does the risk assessment include?
(1) The definition of risk itself. Including the possibility of risk occurrence、risk intensity、duration of risk、areas of risks occur and key risk points.
(2) The definition of the mode of risk. Including whether the impact of risks on enterprises is direct or indirect、whether it will cause other related risks、the scope of the risk to the enterprise.
(3) The definition of risk consequences. In terms of loss: if the risk occurs, how much loss will it cause to the enterprise? How much does it cost to avoid or reduce risk? In terms of the benefits of taking risks: if the enterprise takes risks, how much benefit is possible? If the risk is avoided or reduced, how much benefit does the enterprise get?
How to do risk assessment?
1. Risk identification. Risk identification refers to finding out whether there are risks and what risks exist in each business unit, each important business activity and its important business process.
2. Risk analysis. Risk analysis is a clear definition of the identified risks and their characteristics. It analyzes and describes the possibility and conditions of risk occurrence.
3. Risk evaluation. Risk evaluation assesses the impact of risk on the realization of enterprise goals and the value of risk.
Main tasks of risk assessment
1. Identify various risks faced by the evaluation object.
2. Assess the risk probability and possible negative impact. 3. Determine the ability of the organization to bear risks.
4. Determine the priority of risk mitigation and control.
5. Recommend risk reduction methods.
Attentions during risk assessment
1. What is the object (or asset) to be protected? What is its direct and indirect value?
2. What are the potential threats to the asset? What is the problem that leads to the threat? How likely does the threat occur?
3. What are the weaknesses in the asset that could be used by threats? How easy to use them?
4. Once a threat occurs, what kind of loss or negative impact will the organization suffer?
5. What safety measures should the organization take to reduce the loss caused by risks to the lowest extent?
The relationships should be considered during risk assessment
1. Each asset may face multiple threats
2. There may be more than one threat source (threat agent)
3. Each threat may take advantage of one or more weaknesses
The process of solving the above problems is the process of risk assessment. Risk assessment is important because there will always be things that can't be controlled and there will always be risks. As a manager, he or she will take various measures to reduce the possibility of the occurrence of risk events, or control the possible loss within a certain range, so as to avoid the unbearable loss brought by the occurrence of risk events.
Previous：Materials Required For Trademark Registration In Shanghai And Benefits Of Registration
Next：Import and Export Right License Application