Page 51 - DCAP309_INFORMATION_SECURITY_AND_PRIVACY

Unit 4: Risk Analysis

Notes
Example: It is necessary to clarify whether the risk manager needs estimates of population
or individual risk, or both.
3. The type of risk assessment shall be responsive to the nature of the potential hazard, the
available data, and the decision needs.

Example: If the objective is to decide whether a particular incident requires a product
recall, the risk assessment will focus on that incident and not on the complete risk profile of the
product.

On the other hand, the risk profile should be determined as completely as possible in the
design stage.
Different risk assessment methods or tools are available for these different types of risk
assessment. Selecting the type of risk assessment also means selecting the right methods
and tools.
4. The level of effort put into the risk assessment shall be commensurate with the importance
of the decisions to be made.
This principle is linked with principles 2 and 3 and emphasizes that risk assessments may
vary considerably in scale. The time frame available for decision making may also influence
the scale of the risk assessment.

5. The assessment shall be objective, systematic, structured and – as far as practically possible
– evidence based.
This means that the processes used for risk assessment should be methodical and use
recognized methods to ensure that the results are repeatable and reliable.
An evidence based assessment also implies that efforts are necessary to ensure the
availability of suitable data. Data are necessary at the start to picking up any signals that
may call for a risk assessment, and later in the risk assessment itself. Therefore, an
organization that wants to perform risk assessments needs to prepare itself by establishing
a system for collecting relevant data of good quality or to know where such information
already exists.

6. The risk shall be characterized qualitatively and, whenever possible, quantitatively.
7. Risk Assessment should explicitly describe its own uncertainty and the causes of the
uncertainty.

This may include: providing a range of plausible risk estimates with a quantitative
characterization of risk; for critical assumptions, whenever possible, include a quantitative
evaluation of reasonable alternative assumptions and their implications for the key findings
of the assessment; documenting and disclosing the nature and quantitative implications
of model uncertainty, and the relative plausibility of different models based on scientific
judgment; where feasible, performing a sensitivity analysis; and providing a quantitative
distribution of the uncertainty.
The primary purpose of risk assessment should always be to deal with those aspects of
decision making that are uncertain. If the outcomes of actions or decisions are completely
certain in terms of what will occur, when and its extent and nature, then there is less need
to assess the risks but just manage them and monitor the results. Decision makers need
help understanding where uncertainty lies and how it is best treated and managed.

LOVELY PROFESSIONAL UNIVERSITY 45