5.2 Explain elements of the risk management process

Domain 5: Security Program Management and Oversight

Risk management questions test a full process: identify risks, assess them, analyze them quantitatively or qualitatively, record them, and treat them. Know risk assessment types — ad hoc, recurring, one-time, continuous — and the quantitative formulas cold: single loss expectancy (SLE) equals asset value times exposure factor, and annualized loss expectancy (ALE) equals SLE times annualized rate of occurrence (ARO). Expect at least one calculation. Qualitative analysis uses probability and impact ratings instead of dollars. The four treatment strategies are transfer (insurance), accept (with or without a documented exception), avoid, and mitigate — scenario wording tells you which one is happening. Understand risk appetite (expansionary, conservative, neutral) versus risk tolerance, risk registers with key risk indicators and risk owners, and reporting to stakeholders. Business impact analysis terms cluster here too: RTO, RPO, MTTR, and MTBF. Candidates most often swap RTO and RPO — RTO bounds downtime, RPO bounds data loss — and mislabel buying insurance as acceptance when it is transference.

What you must know

common pitfall · Candidates swap RTO and RPO or label purchasing insurance as risk acceptance when the exam counts it as transference.

Try a sample question

A data center's primary storage array is valued at $400,000. A flood is expected to damage 50 percent of the array, and floods historically occur once every five years. A proposed flood-mitigation system costs $20,000 per year to operate and would reduce flood occurrence to once every 25 years. Based on a quantitative cost-benefit analysis, what should the risk manager recommend?

  • A Reject the control because its annual cost exceeds the single loss expectancy.
  • B Implement the control because the reduction in annualized loss expectancy exceeds its annual cost.
  • C Accept the risk because the asset value is greater than the annualized loss expectancy.
  • D Transfer the risk because quantitative analysis cannot justify purchasing a control.
Show answer & explanations
  • A The single loss expectancy is $400,000 times a 0.5 exposure factor, or $200,000, which far exceeds the $20,000 control cost; SLE alone is also not the correct benchmark for a cost-benefit decision.
  • B correct ·Correct. ALE before the control is the $200,000 SLE times a 0.2 ARO, or $40,000; afterward it is $200,000 times 0.04, or $8,000. The $32,000 annual reduction exceeds the $20,000 annual cost, so the control is financially justified.
  • C Comparing asset value to annualized loss expectancy is not a valid decision rule; asset value almost always exceeds ALE, so this logic would wrongly justify accepting nearly every risk.
  • D Risk transference through insurance is a legitimate strategy, but the quantitative analysis here already justifies mitigation because the annual loss reduction is larger than the control's annual operating cost.

sample item — the full bank runs 450+ questions at exam difficulty

Is objective 5.2 your weak spot?

The free readiness check finds your weakest objectives in 15 adaptive questions — then full access drills them until the gauge clears the cut line.

Check my readiness — free