ISC2 Risk Management Certificate

A risk assessment is only as good as its scope. You set context and criteria, identify assets, threats, vulnerabilities and existing controls, and write risk scenarios that a decision maker can picture.

• Scope, context and risk criteria
• Asset identification and dependencies
• Threat sources and events
• Vulnerabilities and control gaps
• Writing a risk scenario
• Assumptions and how to record them

You build A scoped risk assessment charter with a list of risk scenarios for one business process.

Most organizations start with scales and matrices, and most mistakes happen there. You rate likelihood and impact, build matrices, calibrate analysts to one another, and learn where ordinal scoring misleads.

• Designing likelihood and impact scales
• Building and reading a risk matrix
• Calibrating assessors and reducing bias
• Control effectiveness and residual risk
• Where qualitative scoring breaks down
• Documenting rationale for each rating

You build A calibrated qualitative risk analysis of ten scenarios, with rationale for each rating.

Quantitative methods turn opinion into estimates that can be challenged. You value assets, calculate single and annualized loss, apply FAIR-style decomposition and ranges, and test whether a control is worth what it costs.

• Asset valuation methods
• Single loss, annual rate and annualized loss expectancy
• Frequency and magnitude with FAIR
• Estimating with ranges and calibrated experts
• Monte Carlo simulation in outline
• Cost-benefit analysis of a control

You build A quantitative analysis of two risks with loss ranges and a cost-benefit comparison for their controls.

Resources are limited, so risks must be set against each other. You combine scores, weigh criteria, compare risks on a common scale, and defend the order you choose when two risks look equal.

• Common scales for unlike risks
• Weighted scoring and its pitfalls
• Risk appetite as the line between acting and watching
• Aggregating risks across business units
• Sensitivity analysis: what changes the order
• Presenting a prioritized list

You build A prioritized risk list with scoring method, sensitivity check and a stated cut-off.

Analysis ends when someone acts. You choose among avoiding, reducing, sharing and accepting risk, plan remediation with owners and dates, track residual risk, and set indicators that warn when a risk is rising.

• Treatment options and their consequences
• Selecting controls and compensating measures
• Remediation plans: owners, dates, verification
• Formal risk acceptance and who may sign
• Key risk indicators and triggers
• Reviewing risks on a schedule

You build A treatment and remediation plan for the top risks of a register, with indicators and review dates.

A good analysis can still fail in the room. You write for executives and for engineers, present uncertainty honestly, and turn a risk analysis into a recommendation that a decision maker can approve.

• Knowing your audience and their decision
• Reporting formats: register, heat map, narrative
• Presenting uncertainty without losing the point
• Recommendations with options and consequences
• Handling challenge and disagreement
• Follow-up after a decision

You build A two-page risk recommendation and a short briefing for an executive audience.

Run the entire method on a single case. You frame the scope, identify and analyze risks both ways, set priorities, plan treatment and present the result with the evidence that supports it.

• Scoping the process and its criteria
• Identifying scenarios
• Analyzing with qualitative and quantitative methods
• Prioritizing and planning treatment
• Writing and presenting the recommendation

You build A complete risk analysis report for one business process, with ranked risks and a recommendation.