Risk Treatment

00:00

Hey, guys, Welcome to another episode of the S S C P Exam Prep. Siri's I'm your host, Peter Similar. This is the second dope lesson in the third domain

00:12

So far in the third domain. We've talked about the risk management process, how to assess risk and organization faces any any given time by taking a risk assessment with the four steps off, prepared for the risk assessment, taking the risk assessment,

00:31

communicating the results

00:33

and finally maintaining the risk assessment.

00:36

Now in this lesson will be looking at how to properly handle or treat the risk that we assessed in the last last

00:47

Let's get started.

00:49

Once we have established our risk assessment and we know the risk an organization faces were gonna want Oh, we're gonna want to treat the risk. We're gonna want to do things to it so we can reduce it to an acceptable level or a level that is

01:06

reasonable for organization. If the risk is already

01:10

at an acceptable level, will look at that too.

01:12

Holdovers treatment is to reduce risk.

01:17

There are four main ways of reducing risk

01:22

on therefore risk treatment methods are one

01:26

risk mitigation

01:27

where we implement controls to take care of the risk.

01:32

Two.

01:33

Risk transference. It's where we transfer the risk to 1/3 party.

01:38

Three. Risk avoidance where we just avoid the risk completely

01:44

or four. Risk acceptance where we accept the risk.

01:49

So let's look at these in a little bit more detail,

01:53

so risk mitigation reduces the risk by implementing some sort of controls. It brings the risk from a high level down to a low. This the whole point off implementing even having different controls,

02:09

transferring to want to transfer the risk to 1/3 party. An example of this would be transferring on some to 1/3 party vendor or an insurance company to where they assume responsibility for the risk. So if anything happens to you, they're on the hook for

02:29

another type of rest. Treatment is risk avoidance where we just completely avoid the risk.

02:35

Anything that we are trying to do, any any process or step that would bring too much risk to an organization should be cut off and completely avoided.

02:46

In the last step is risk acceptance

02:50

where we understand that we will have some sort of risk.

02:54

But the risk is low enough to where it won't necessarily hurt the organization a whole lot. Or if the risk is low enough and the reward for doing whatever we're doing is great enough to wear that having that risk is okay.

03:13

So

03:14

which, which was treatment should you use? Which one should you implement? Well, that's why we have this little diagram on the right hand side of the screen,

03:23

as we can see in the ER,

03:27

why access? We have high probability and low probability, and on the X axis, we have low impact and high impact.

03:36

So depending on e status or the state of your organization, it really depends

03:44

what you're trying to do

03:46

and what the results would be. So in a situation where

03:51

there is a high probability that something will happen and the impact to implementing whatever you're implementing is also very, very high, where it could be utterly destroyed, then you want to completely avoid that risk. Avoid that whole area in the first quadrant.

04:11

If you're going to have a high probability of something happening,

04:15

born.

04:15

If even if it does happen, it won't hurt a whole lot. You might want to consider transferring the risk to 1/3 party or insurance company.

04:26

If you if there's a low probability off

04:30

risk happening or the vulnerability happening, and the impact is also very, very low than

04:35

you might wanna consider accepting the risk.

04:39

If the benefits outweigh the risk, then you definitely want to think about this and talk about this in your organization and the last quadrant. If there's a low probability off, something happened. But if it happens, it's going to be really, really bad. Then you might want to implant some

04:57

technical managerial war.

05:00

Operational controls.

05:01

Risk visibility and importing

05:04

risk should always be recorded

05:06

and reported on it. Should there shouldn't be any surprises when it comes to risk. Risk should have very high visibility. Risk needs to be broken down and analyzed and aggregated

05:23

so it can be looked at easily.

05:26

Brisket that needs to be aggravated could be done in a risk register, which is a book or a sheet of paper or some sort of spread sheet that gives information about different aspects of risk in organization.

05:40

Great part about a risk register is that a lesson organization know their exposure at any given time, so if they just want a very brief, you know, high level overview off their exposure than they look at that. Or if they want to look at a specific risk,

05:57

they can do that too.

06:00

This is an example. Off a risk register. This is just

06:03

one line in the spreadsheet off the risk register, and these have been different categories. So you have an I. D. Number. They raised that where this risk was brought to the attention of the organization,

06:16

the description of the risk. What kind of risk is it?

06:20

What is the likelihood that this is gonna happen

06:24

if it actually happens? What is the impact? How severe is this impact?

06:29

You have an owner person who is responsible for handling this risk.

06:33

You want to keep track of any mitigating or contingent action you always want document every single action you have

06:42

just in terms off good visibility, so people can see that this risk is either being avoided or mitigated or transfer or accepted.

06:54

You definitely want to have a progress on any actions that are going on. And you wanna have a current status Where where what is the status over this risk

07:03

To have a good risk register right. There are four good steps. The four step for addressing risk management. One. Identify the risk

07:13

to evaluate the severity of any identified risks. How bad are these risks?

07:18

We want to apply any and all possible solutions to these risk. This comes in the form of transferring the risk to an insurance company or implementing some controls. And finally, we want to monitor and analyze the effectiveness of any of the subsequent steps taken instead through.

07:39

So we want to see okay, if we transfer this risk to 1/3 party vendor, does that reduce our level of exposure

07:47

or if we want to?

07:50

Implements and controls are the controls doing their job is our level of risk going down enough to an acceptable level?

08:00

In today's lecture, we discussed Rhys treatment. We looked at the four different ways of handling risk, and we looked at risk registers, which are a good way to look at the exposure of an organization at any given time.

08:16

This time,

08:18

all of these are acceptable ways of handling risk except a risk in hands.

08:24

Be risk mitigation,

08:26

see risk avoidance or D risk transference.

08:33

If you picked a, then you are correct. Risk enhances not an acceptable way off handling risk. There is no good reason why you'd want to enhance the rescue already currently facing.