GRC & Audit Support · Lesson 2 of 8
Writing a useful risk statement
A risk statement explains what could happen, why it could happen, and how the organization could be affected. Avoid vague entries such as bad security.
Turn a weakness into a risk statement
Fictional evidence: a sample of unclosed offboarding tickets.
- Weakness
Departed staff may retain active accounts.
- Possible event
Someone uses the remaining access without authorization.
- Business consequence
Customer-order information could be exposed.
Read the visualWhich part explains why the business should care?
The potential consequence to customer information and the business. A weakness alone does not explain the impact.
Describe a scenario
Connect a threat or event to a weakness and an affected asset. State assumptions.
Explain business impact
Describe a plausible effect on operations, information, finances, or people without inventing certainty.
Separate facts and estimates
Document evidence for the weakness and the basis for likelihood and impact judgments.
Put it in context
Because departed staff retain active accounts, unauthorized access to customer orders could expose information. The evidence is a sample of unclosed offboarding tickets.
Connect a specific weakness to a plausible event and consequence.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.