How to set up a risk management process and improve information security

Market conditions are changing faster than ever. Digital transformation drives businesses into the cloud. Artificial Intelligence enters a new stage of evolution with unclear implications. The long tail of COVID-19 and war in Europe shake up long-held beliefs.

The ability to navigate risks has become an essential quality for all organisations. With a solid and tailored risk management process, your company can not only reduce uncertainty but stand out from the competition.

This article aims to provide you with an understanding of risk management, its implementation, and its relationship with information security.

What is Risk Management? 

Risk management methodically recognises, evaluates, and addresses possible risks impacting an organisation's objectives, assets, or stakeholders. It's crucial to understand that every business has its own risks based on the industry and circumstances. Therefore, a successful risk management strategy should offer personalised procedures to analyse and manage risks within the company. 

As businesses increasingly use internet technologies like mobile computing and cloud services, they face various cybersecurity risks. Managing those risks plays a particularly important role in InfoSec. 

Obtaining the ISO 27001 certification is essential for companies that handle large amounts of user data. This is especially true for companies in critical infrastructure sectors like healthcare and finance. ISO 27001 is the international standard for InfoSec and provides a framework for establishing an Information Security Management System (ISMS). The ISMS implements controls to manage risks in the organisation, making it a crucial component for long-term success. 

Learn more about effective risk management for ISO 27001 certification in our free webinar.




Create the risk management process 

The risk management process involves three key steps:

  1. Identify and assess risks
  2. Create a risk treatment plan
  3. Review residual risks

In the following, we will explore each of the steps individually and give guidance on how to follow best practices. Let's jump in.


1. Identify and assess risks

There are various approaches that can be used to identify and assess the individual risks an organisation is facing. Some of the most commonly used are asset-based, vulnerability-based, threat-based and scenario-based assessments. Each comes with specific strengths and weaknesses and serves particular use cases.

Before starting a risk assessment, it's important to decide which analysis methods to use. There are two main categories: qualitative and quantitative methods.

  • Qualitative risk analysis

Qualitative risk analysis can, for example, involve conducting expert interviews, both internal and external. To gain insight into potential risks and their implications.

Brainstorming sessions can uncover risks that may have been missed in a structured analysis. The main challenge can be individual cognitive biases and varying work experiences that can sometimes hinder the process.

However, in situations where there is limited data available or technical expertise in the organisation is lacking. Qualitative analysis methods can be an accessible and low-cost way to effectively strengthen the risk assessment approach.

  • Quantitative risk analysis

Quantitative risk analysis is more advisable when an abundance of structured data and technical expertise is available. It uses numerical data, statistical techniques and mathematical models to evaluate risks.

Common techniques include:

  • Assigning numerical probabilities and impact values to risks, allowing for objective comparison and prioritisation of risks (Probability and Impact Analysis). 
  • Calculating potential financial impact by multiplying the probability of risk occurrence by the estimated monetary impact (Expected Monetary Value Analysis, EMV). 

In practice, using a combination of qualitative and quantitative methods provides a more comprehensive understanding of an organisation's risk landscape. When explaining the four assessment approaches in greater detail below, we will give recommendations on the risk analysis methods best suited for each.

Asset-based assessment

Asset-based risk assessment focuses on identifying risks based on an organisation's assets. These assets can include physical infrastructure, technology systems, and intellectual property. Potential threats and vulnerabilities to these assets and their impact on the organisation are assessed, mostly by using quantitative analysis methods.

This approach enables organisations to identify and protect their most valuable assets. However, the limited scope of the investigation may cause overlooking risks not directly associated with assets.

Vulnerability-based assessment 

Vulnerability-based assessments focus on identifying risks associated with an organisation's vulnerabilities, such as weak security protocols or inadequate employee training. The assessment involves identifying vulnerabilities and assessing their potential impact, often through methods like employee interviews. Once vulnerabilities are identified, strategies can be developed to address them.

Threat-based assessment

The threat-based assessment focuses on identifying potential risks based on specific threats that an organisation may face. These can include cyber-attacks, natural disasters, or human error. What is the difference between looking at threats and vulnerabilities? A threat is something that exploits a vulnerability.

For example, a hacker carrying out an exploit is a threat. They are looking to find a certain software vulnerability in the attacked system. From assessing the risks in more detail, you can discover and calculate the likelihood of that certain risk from emerging.

This approach is more suitable for qualitative analysis methods like expert interviews. However, it does come with the usual caveats of such methods, like biased expert opinions.

Scenario-based assessment

When choosing a scenario-based assessment approach, an organisation develops hypothetical scenarios and identifies the risks associated with those scenarios. By developing strategies to mitigate those risks, organisations can be better prepared to respond if those risks do materialise. This can help to reduce the potential impact of risks on their operations and minimise associated costs or damages.

Additionally, scenario-based assessments encourage organisations to consider potential risks and their impacts creatively and proactively. This approach can help identify risks that may have been overlooked by other methods and assist in prioritising risk management efforts.

For these reasons, DataGuard recommends using the scenario-based approach. To learn more and receive guidance from our industry experts, feel free to get in touch!


2. Create a risk treatment plan

Once potential risks have been identified and assessed, a risk treatment plan is developed to manage or mitigate those risks. Regardless of industry, four fundamental ways to handle risks in business have been established:

  1. Avoid risk
    The "avoid risk" treatment option involves eliminating the risk by taking actions that remove its source. This can include discontinuing activities, withdrawing from markets, or not pursuing projects. Avoidance is often preferred when the potential impact of the risk is significant, and its likelihood of occurrence is high.
  2. Mitigate risk

    The mitigate risk treatment option involves taking actions that reduce the likelihood or impact of the risk. This involves implementing controls, procedures, or policies to minimize the chances of occurrence or lessen the potential impact. Mitigation is preferred when the risk's potential impact is significant but the likelihood of occurrence is low.

  3. Transfer risk

    The transfer risk treatment option involves shifting the risk to another party. This option may include purchasing insurance or outsourcing a particular activity to a third-party provider. Transfer is often preferred when the risk's potential impact is substantial, and the organisation is unwilling or unable to assume it.

  4. Accept risk
    The accept risk treatment option involves acknowledging the risk and making a decision to tolerate the potential impact. This approach may involve implementing monitoring or contingency plans or accepting the impact as a cost of doing business. Acceptance is often preferred when the potential impact is low, and the organisation is willing to assume the risk.


3. Review and uncover residual risks

A review of the risk treatment plan follows its setup to assess its effectiveness and identify any residual risks.  Those residual risks can then be integrated into the plan using the strategies outlined above. The goal of the review is to ensure that the risk management process is ongoing and continually monitored. Any changes to the organisation’s operations or external environment should be considered.

Organisations can ensure the effectiveness of their risk management by continuously reviewing residual risks. Thereby reducing the potential impact and cost of changes in their risk landscape.


How DataGuard helps you achieve ISO 27001 certification with risk management 

Adopting best practices and standards in risk management is crucial. It ensures a consistent and structured approach to addressing risks aligning you with global benchmarks and industry requirements. By getting certified, organisations can demonstrate to their customers that their data is in safe hands and build trust.

ISO 27001 is an international standard for information security that can help businesses protect their information assets and comply with regulations. The standard provides a framework to establish, implement, maintain, and continually improve an Information Security Management System (ISMS). Managing risks is a fundamental component of that.

At DataGuard, we offer expert guidance and customised solutions to support your risk management efforts. Our services include ISO 27001 certification, GDPR compliance, and tailored risk management strategies to address your organisation's unique challenges.


About the author

Emrick Etheridge Emrick Etheridge
Emrick Etheridge

Emrick Etheridge is an associate Information Security Consultant and a certified ISO 27001 Lead Auditor. Prior to DataGuard, Emrick studied Computer Science at Anglia Ruskin University (Cambridge) before entering a world of Digital Forensics and Information Security for a Cambridge based company. In these roles, he consulted merchants who required either a digital forensic investigation or re-certification. Emrick was also a certified Cyber Essentials assessor at the heart of the pandemic which proved to be an interesting time in industry. In his current role, he helps SMEs create an Information Security Management System (ISMS) to strengthen their security posture as well as consulting them on their path to obtaining ISO 27001 certification.

Explore more articles

Contact Sales

See what DataGuard can do for you.

Find out how our Privacy, InfoSec and Compliance solutions can help you boost trust, reduce risks and drive revenue.

  • 100% success in ISO 27001 audits to date 
  • 40% total cost of ownership (TCO) reduction
  • A scalable easy-to-use web-based platform
  • Actionable business advice from in-house experts

Trusted by customers

Canon  Logo Contact Hyatt Logo Contact Holiday Inn  Logo Contact Unicef  Logo Contact Veganz Logo Contact Burger King  Logo Contact First Group Logo Contact TOCA Social Logo Contact Arri Logo Contact K Line  Logo Contact

Get to know DataGuard

Simplify compliance

  • External data protection officer
  • Audit of your privacy status-quo
  • Ongoing GDPR support from a industry experts
  • Automate repetitive privacy tasks
  • Priority support during breaches and emergencies
  • Get a defensible GDPR position - fast!

Trusted by customers

Canon  Logo Contact Hyatt Logo Contact Holiday Inn  Logo Contact Unicef  Logo Contact Veganz Logo Contact Burger King  Logo Contact First Group Logo Contact TOCA Social Logo Contact Arri Logo Contact K Line  Logo Contact

Get to know DataGuard

Simplify compliance

  • Continuous support on your journey towards the certifications on ISO 27001 and TISAX®️, as well as NIS2 Compliance.
  • Benefit from 1:1 consulting
  • Set up an easy-to-use ISMS with our Info-Sec platform
  • Automatically generate mandatory policies

100% success in ISO 27001 audits to date



TISAX® is a registered trademark of the ENX Association. DataGuard is not affiliated with the ENX Association. We provide consultation and support for the assessment on TISAX® only. The ENX Association does not take any responsibility for any content shown on DataGuard's website.

Trusted by customers

Canon  Logo Contact Hyatt Logo Contact Holiday Inn  Logo Contact Unicef  Logo Contact Veganz Logo Contact Burger King  Logo Contact First Group Logo Contact TOCA Social Logo Contact Arri Logo Contact K Line  Logo Contact

Get to know DataGuard

Simplify compliance

  • Proactive support
  • Create essential documents and policies
  • Staff compliance training
  • Advice from industry experts

Trusted by customers

Canon  Logo Contact Hyatt Logo Contact Holiday Inn  Logo Contact Unicef  Logo Contact Veganz Logo Contact Burger King  Logo Contact First Group Logo Contact TOCA Social Logo Contact Arri Logo Contact K Line  Logo Contact

Get to know DataGuard

Simplify compliance

  • Comply with the EU Whistleblowing Directive
  • Centralised digital whistleblowing system
  • Fast implementation
  • Guidance from compliance experts
  • Transparent reporting

Trusted by customers

Canon  Logo Contact Hyatt Logo Contact Holiday Inn  Logo Contact Unicef  Logo Contact Veganz Logo Contact Burger King  Logo Contact First Group Logo Contact TOCA Social Logo Contact Arri Logo Contact K Line  Logo Contact

Let's talk