Study Guide
Treating Risk
The risk lifecycle, the four Ts, inherent and residual risk, risk appetite, tolerance and capacity, choosing controls and recording decisions.
Lesson 5.6 Governance, Risk & Compliance
Assessing a risk is only useful if it leads to a decision. This lesson works out the choices an organisation has once a risk is understood, how to tell what remains after acting, and how much remaining risk it should be willing to live with. It completes the customer-database scenario followed through Risk, Assessing Risk and Quantifying Impact.
Stage: Think
After the assessment
Think it through
An old server that can no longer receive security updates has been assessed as a serious risk. List every kind of thing an organisation could do about it, including things that do not involve fixing the server.
- Hint 1: Could someone else pay for the consequences?
- Hint 2: Could you simply stop using it?
Think it through
Show the answer
Answer: C. Only some, if the control works.
Only some of it, and only if the control is shown to work. What remains is still a risk to decide about.
Stage: Explain
Measurement and lifecycle
Think it through
Why is dealing with a risk a loop rather than a single job that ends when a control is installed?
- Hint 1: What might change after the control is in place?
Show what happens
Because systems, people and attackers change, and a control may not work as intended: you have to check what you did and look again.
Dealing with a risk is a loop, not a single act. You find the risk, work out how serious it is, do something about it, and then check whether what you did worked. Then you look again, because systems and attackers both change.
The usual shorthand for the loop is Identify → Assess → Treat → Monitor / Review. The diagram shows it in six steps, using the customer-database risk from the last three lessons. The earlier lessons covered the first four steps. This lesson is about the fifth, Treat, and what follows it. (Different frameworks name the stages a little differently.)
An educational lifecycle using the customer-database scenario, one stage at a time. Review feeds back into context and identification whenever conditions change.
Context
Step 1 of 6: Define the objective and criteria
Protect customer information and keep essential activities working. Set scope, owners, assessment period and decision thresholds.
Identify
Step 2 of 6: Describe what could happen
Connect the database, weak access controls and stolen credentials to a plausible unauthorised-access incident and its consequences.
Analyse
Step 3 of 6: Understand likelihood and impact
Examine exposure, permissions, dependencies and evidence. Record assumptions and uncertainty; use BIA findings to inform consequences.
Evaluate
Step 4 of 6: Compare with the criteria
Decide whether the assessed risk is within defined limits, which findings need priority and when escalation is required.
Treat
Step 5 of 6: Select, implement and check a response
Assign an owner and actions. Apply suitable controls or choose another treatment, then assess the remaining risk using evidence of effectiveness.
Monitor and review
Step 6 of 6: Communicate and revisit
Check actions, control performance and residual risk. New access paths, incidents or changing business needs feed back into the next assessment.
After monitoring and review, the loop returns to context and identification.
Check your understanding
Show the answer
Answer: B. Review.
Monitor and review: check that the treatment works and what risk remains, then feed changes back into the loop.
Review → revisit the context and identify changes. The diagram is not a one-off checklist ending when a control is installed. Monitoring and communication continue between formal reviews. Analysis estimates the risk; evaluation compares it with criteria to decide what attention it needs.
A useful decision record connects the scenario, assessment, assumptions, selected treatment, accountable owner, remaining risk and review arrangements. This explains the information needed for a decision without claiming that a formal risk register or professional assessment has been completed.
Stage: Predict
Risk treatment options
The four Ts are Treat, Transfer, Tolerate and Terminate. The terms Mitigate, Transfer, Accept and Avoid broadly describe the same choices. “Treat” has two uses: the lifecycle’s treatment stage covers choosing a response; the specific T means reducing risk through controls.
The legacy-server scenario
A vulnerable legacy server is a useful way to compare the choices. Take the case where the server cannot receive current security updates. Patching is appropriate where a supported fix exists; for this unsupported-server variation, “just patch it” is not an available solution.
Think it through
The legacy server cannot be patched. For each of the four Ts, suggest one concrete action.
- Hint 1: Which T means removing the cause altogether?
Show what happens
Treat: isolate it and monitor it. Transfer: insure specified consequences. Tolerate: an authorised owner formally accepts what remains. Terminate: retire the server or stop the activity. The table works through each.
| Response | Worked decision | What still needs attention |
|---|---|---|
| Treat / Mitigate | Isolate the server, restrict access and improve monitoring while planning replacement. | Check that isolation and permissions work and that alerts lead to action. Compensating controls do not remove the unsupported software. |
| Transfer | Use appropriate insurance or contractual arrangements for specified consequences. | Understand what is covered and what remains. Payment arrangements do not repair the vulnerability or automatically transfer accountability. |
| Tolerate / Accept | An authorised owner formally accepts the remaining risk within the relevant criteria. | Record the rationale, owner and review date. Acceptance is not an informal instruction to ignore the server. |
| Terminate / Avoid | Decommission the server or stop the activity creating the risk. | Identify and remove dependencies safely, and handle retained information appropriately. Switching it off without planning may cause another disruption. |
The options can be combined. Temporary isolation and monitoring may operate alongside insurance while replacement is arranged. The decision should state which part of the risk each action addresses and who owns the remainder.
Check your understanding
Show the answer
Answer: C. Some costs are now covered.
Some financial consequences are covered. The weakness remains, and so does the organisation’s accountability.
Transferring some financial consequences does not guarantee that a supplier will prevent an incident, remove the underlying technical weakness or relieve the organisation of its applicable obligations. Likewise, accepting a risk requires appropriate authority and cannot override requirements the organisation must meet.
Stage: Predict
Inherent and residual risk
Think it through
You want to show that a set of controls made a difference to a risk. Which two assessments would you need, and what must be the same about them?
- Hint 1: What would make a before-and-after comparison unfair?
Show what happens
One before the controls and one after, using the same baseline and criteria, so that the comparison is fair.
Inherent risk is assessed before taking account of the controls being evaluated. Residual risk is what remains after considering those controls and their effectiveness. State the baseline explicitly: “before controls” must not silently mean different things in two assessments being compared.
Reassess the database scenario
As a worked educational extension, suppose the service exposed to unauthorised access is initially assessed as high risk under the organisation’s criteria. This is a hypothetical judgement, not an established score.
- Define the initial exposure. Stolen credentials and excessive permissions may allow access to customer records; the assessment records what is known and uncertain.
- Apply relevant controls. Restrict access to appropriate accounts, review permissions and monitor activity with a defined response process.
- Gather evidence of effectiveness. Verify that unauthorised accounts are denied, permissions match intended tasks and alerts reach someone able to act. Merely installing a tool or writing a policy is insufficient.
- Reassess likelihood and impact. Effective restrictions may reduce opportunities for misuse. Monitoring may help detect and contain it, but does not necessarily prevent initial access or reverse a disclosure that has already happened.
- Compare the residual risk with the criteria. If it remains outside tolerance, apply further treatment or escalate to the authorised decision-maker. Document the reasoning and arrange review.
Check your understanding
Show the answer
Answer: A. No: nothing shows it works.
No. An alert nobody reads protects nothing; residual risk depends on evidence that controls work.
There is no automatic “high becomes low” step. A misconfigured control, an unmonitored alert or a bypassable access path may provide less protection than intended. Even effective controls rarely justify a guarantee of zero risk. Planned controls should not be counted as already effective.
A supplementary illustration of the last step of the reassessment: what happens once the residual risk has been reassessed using evidence.
Starting pointThe residual risk has been reassessed, using evidence that the controls work.
✓ Within tolerance
- An owner with the right authority accepts the remaining risk.
- The decision, owner and review date are recorded.
- Monitoring continues, and a change in conditions triggers reassessment.
OutcomeThe risk is tolerated at its residual level, knowingly and for a stated period.
✗ Outside tolerance
- Apply further treatment, which may combine options.
- Or escalate to someone with authority to decide.
- Record the gap and any interim measures.
OutcomeThe risk is not treated as acceptable until it is back within tolerance or knowingly accepted at the right level.
Stage: Predict
Risk appetite and risk tolerance
Think it through
Think about spending on a night out. How much would you like to spend, how far over that before you stop, and how much could you lose without real trouble? Are those the same number?
- Hint 1: Is “the most I could afford” the same as “what I plan to spend”?
Show what happens
No: what you are willing to spend, the limit at which you act, and what you could survive are three different amounts. Organisations distinguish risk in the same three ways.
Risk appetite, risk tolerance and risk capacity answer different questions. Terminology varies between frameworks, so an organisation needs explicit definitions and decision rules.
| Concept | Meaning | Question to ask |
|---|---|---|
| Risk appetite | The broad amount and type of risk the organisation is willing to pursue or retain in seeking its objectives. | What kinds of uncertainty are we willing to take for this objective? |
| Risk tolerance | Defined acceptable limits or variation around objectives. The emphasis is on thresholds beyond which action or escalation is required. | At what specific limit must we act or escalate? |
| Risk capacity | The maximum risk or loss the organisation can withstand. | What could the organisation survive, rather than choose to accept? |
Organisational context
Compare a startup developing a new service with a bank. A startup may accept more uncertainty around product experimentation, while a bank may have lower appetite in some risk areas because of its obligations, dependencies and potential consequences. These are illustrative comparisons, not universal rules about either type of organisation. Appetite depends on the objective and risk category, not simply the organisation’s label.
A measurable disruption threshold
An example is a service with a tolerance of no more than one hour of disruption before escalation. This turns a broad intention into a specific operational threshold. To be usable, it also has to say who measures the disruption, who is told when the hour is up and what they are expected to decide.
Check your understanding
Show the answer
Answer: C. No: the hour is when to escalate.
No. The hour is the point at which escalation is required, not permission to ignore the incident until then.
The hour is not a promise of recovery performance, permission to ignore an incident until the hour expires, or proof that the organisation cannot survive a longer outage. The last question concerns capacity, which requires separate consideration. An organisation might be capable of surviving a loss it is unwilling to tolerate in routine operations.
Two prompts help to keep the first two apart: appetite is “how much risk do we want to take?” and tolerance is “how far from that may we drift before someone must act?”. Capacity is the third and hardest limit: “how much could we survive?”
Stage: Predict
Choosing controls
Think it through
Treating a risk usually means choosing controls. The following questions help compare options:
- Which part of the scenario does it act on? A control can reduce the threat’s opportunity, remove the vulnerability, lower the likelihood or limit the impact. Multi-factor authentication acts on likelihood; tested backups act on impact.
- What function does it serve? Defence in Depth groups controls as preventative, detective, responsive and recovery. A plan relying on one function alone is fragile.
- Is it proportionate? Compare its cost with the reduction in risk it is expected to achieve, as in the worked control comparison.
- What new problems might it create? A control that makes work much harder may be bypassed. Security, Usability & Functionality explores that trade-off.
- How will anyone know it works? Decide in advance what evidence will show the control is operating, because residual risk depends on demonstrated effectiveness.
Frameworks can suggest suitable controls. ISO/IEC 27002 offers control guidance and Cyber Essentials sets five baseline control areas; Security Frameworks and Standards covers both.
Stage: Explain
Recording the decision
A treatment decision needs a risk owner: a person with the authority and accountability to manage the risk and accept what remains. Many organisations keep a risk register, a record of each identified risk with its assessment, treatment, owner and review date. The example below is fictional.
| Field | Customer-database entry (fictional) |
|---|---|
| Risk | An attacker using stolen credentials exploits weak access controls to reach the customer database, exposing customer information. |
| Inherent rating | Likelihood 4 × Impact 4 = 16, High. |
| Treatment | Treat: multi-factor authentication and a permissions review, with access monitoring. |
| Evidence | Authentication settings checked; permission review completed; test alert received and handled. |
| Residual rating | Likelihood 2 × Impact 4 = 8, Medium. |
| Tolerance | This fictional organisation allows the service owner to accept Medium risks; High risks go to the leadership team. |
| Decision and owner | Residual risk accepted by the customer-service owner, within tolerance. |
| Review | In six months, or sooner after an incident or a change to the system. |
Check your understanding
Show the answer
Answer: B. Medium is within their authority.
The residual risk was Medium, and this organisation allows service owners to accept Medium risks; a High one would go to the leadership team.
The ratings are the ones worked out in Assessing Risk. The register does not replace judgement; it makes the judgement visible, so it can be checked and revisited.
A risk that has been “accepted” without a named owner, a recorded reason and a review date has usually just been ignored. Asking who accepted it, on what basis and until when is a quick test of whether a treatment decision was really made.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
Show the answer
Answer: A. What still depends on it.
What depends on it and what information it holds, so that switching it off does not cause a new disruption or lose data that must be kept.
Apply it
Show the answer
Answer: C. That is capacity.
The most an organisation could survive is its capacity. Tolerance is a limit it chooses, usually well inside capacity, at which it acts or escalates.
Apply it
Show the answer
Answer: B. Their appetite for this risk differs.
Their appetite for this kind of risk differs, shaped by their objectives, obligations and the consequences of failure.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: Identify, analyse, evaluate against criteria, treat, then monitor and review as conditions change.
Analysis estimates likelihood and impact; evaluation compares risk with criteria; treatment chooses a response. Monitoring and review revisit assumptions and control effectiveness rather than ending at installation.
Revision sources: Session 3: Governance, Risk and Compliance (Classroom session record) · Session 4: Governance, Risk and Compliance — In Depth (Classroom session record) · Risk (Supplementary Study Guide explanation)
Show answer
Answer: Treat / Mitigate
Compensating controls seek to reduce risk: Treat/Mitigate. They do not remove unsupported software, and their effectiveness needs checking. The broader treatment stage includes all four choices.
Revision sources: Session 3: Governance, Risk and Compliance (Classroom session record) · Session 4: Governance, Risk and Compliance — In Depth (Classroom session record) · Risk (Supplementary Study Guide explanation)
Show answer
Answer: This transfers specified financial consequences but does not repair the server or automatically remove accountability.
Transfer can allocate specified consequences subject to the arrangement. It is distinct from technical remediation and does not automatically remove duties or the need to manage residual risk.
Revision sources: Session 3: Governance, Risk and Compliance (Classroom session record) · Session 4: Governance, Risk and Compliance — In Depth (Classroom session record) · Risk (Supplementary Study Guide explanation)
Show answer
Answer: Tolerate / Accept
Formal acceptance within relevant criteria is Tolerate. It needs authority and review; it is not an instruction to ignore the issue or override mandatory obligations.
Revision sources: Session 3: Governance, Risk and Compliance (Classroom session record) · Session 4: Governance, Risk and Compliance — In Depth (Classroom session record) · Risk (Supplementary Study Guide explanation)
Show answer
Answer: Terminate / Avoid
Avoidance stops the risk-creating activity. Planning matters because abruptly switching off a service can cause a separate disruption.
Revision sources: Session 3: Governance, Risk and Compliance (Classroom session record) · Session 4: Governance, Risk and Compliance — In Depth (Classroom session record) · Risk (Supplementary Study Guide explanation)
Show answer
Answer: Tests show unauthorised accounts are denied.; Permission reviews match access to intended duties.; Alerts reach staff who can act and response arrangements are checked.
Residual risk must consider effective operation. Buying or installing a control does not prove it is configured correctly, used or monitored. Even effective controls do not guarantee zero risk.
Revision sources: Session 4: Governance, Risk and Compliance — In Depth (Classroom session record) · Risk (Supplementary Study Guide explanation)
Show answer
Answer: True
Tolerance is the action or escalation threshold; appetite is the willingness to accept risk in pursuit of objectives.
Revision sources: Session 3: Governance, Risk and Compliance (Classroom session record)
Show answer
Answer: A defined risk-tolerance threshold.
Tolerance is the chosen acceptable limit or escalation point. Capacity concerns what can be withstood; appetite concerns willingness in pursuit of objectives. The threshold is neither a recovery guarantee nor permission to ignore an incident until an hour passes.
Revision sources: Session 3: Governance, Risk and Compliance (Classroom session record) · Session 4: Governance, Risk and Compliance — In Depth (Classroom session record) · Risk (Supplementary Study Guide explanation)
Show answer
Answer: It cannot be checked: with no owner, reason or review date, the risk was probably just ignored.
A treatment decision needs a risk owner, a person with the authority and accountability to accept what remains, and a risk register records each risk’s assessment, treatment, owner and review date. An acceptance without a named owner, a recorded reason and a review date has usually just been ignored. Accepting a risk can be legitimate when someone authorised decides it; the problem is that nothing shows who decided, why or until when. A severity score can inform an assessment, but it does not replace the decision record.
Revision sources: Treating Risk (Supplementary Study Guide explanation)
Show answer
Answer: The decision goes to the leadership team, because High is above what the owner may accept.
The residual rating is compared with the organisation’s limits to decide who may accept it. A High residual rating is beyond what a service owner may accept here, so it goes to the leadership team, or receives further treatment. Changing the rating to fit the owner’s authority would hide the real position, and deleting the entry would lose the record that makes the decision checkable.
Revision sources: Treating Risk (Supplementary Study Guide explanation)
Study and revision
This lesson has the largest share of the approved risk questions. Practise them, and the four Ts, residual-risk, capacity and risk-register flashcards, through the Risk Management topic. The risk-register questions draw on this lesson’s supplementary explanation. They are learning-only, with no verified exam alignment.
Stage: Consolidate
What to remember
- Risk management is a loop: identify, assess, treat, then monitor and review as things change.
- The four Ts are Treat, Transfer, Tolerate and Terminate, and they can be combined.
- Inherent risk is before the controls being evaluated; residual risk is what remains, judged on evidence that they work.
- Appetite is what we want to take, tolerance the limit at which we act, capacity what we could survive.
- Every accepted risk needs an owner with authority, a recorded reason and a review date.
Key terms
- Four Ts
The four classroom options for responding to a risk: Treat (mitigate), Transfer (shift specified consequences), Tolerate (accept with authority) and Terminate (stop the activity).
- Inherent risk
Risk assessed before the controls being evaluated are taken into account.
- Residual risk
The risk that remains after considering the demonstrated effectiveness of controls.
- Risk appetite
How much risk an organisation is willing to accept in pursuit of its objectives.
- Risk tolerance
The threshold beyond which action or escalation becomes necessary.
- Risk capacity
The maximum loss or disruption an organisation can withstand.
Common misunderstandings
Insurance or a contract can move some financial consequences. The organisation remains accountable, and the weakness is still there.
Acceptance is a recorded decision by someone with authority, with a review date. It cannot override legal obligations.
Residual risk depends on evidence that the control works. Even effective controls rarely reduce risk to zero.
That is risk capacity. Tolerance is the limit an organisation chooses, beyond which it acts or escalates.
Lesson sources and acknowledgements
Sources and scope
- Taught in Session 3 (see the Session 3 Learning Log): the Identify, Assess, Treat, Monitor lifecycle; Treat, Transfer, Tolerate and Terminate, and the handbook terms Mitigate, Transfer, Accept and Avoid; risk appetite and risk tolerance with their memory prompts; risk registers as a topic for further study.
- Taught in Session 4 (see the Session 4 Learning Log): the lifecycle; the four Ts applied to a legacy server; inherent and residual risk; appetite, tolerance and capacity; the startup and bank comparison; the one-hour disruption threshold.
- Moved from an earlier lesson: “Measurement and lifecycle”, “Risk treatment options”, “The legacy-server scenario”, “Inherent and residual risk”, “Reassess the database scenario”, “Risk appetite and risk tolerance”, “Organisational context” and “A measurable disruption threshold” were previously part of Risk and keep their wording and anchors here. They develop the supplied, reconstructed GRC educational reference.
- Supplementary explanation: the residual-risk decision diagram, choosing controls, risk owners and the risk register example, the practical note and the misunderstandings.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the opening questions about an unpatched server and an installed control, every question asked in the lesson with its feedback and hints, the application questions and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- No practical work is claimed. The organisation, ratings and register entry are fictional.
Establishing or verifying a claimed identity, for example when a user signs in.
An alternative safeguard used when the preferred control cannot be implemented, reaching a similar security objective another way.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
A UK certification scheme covering five technical control areas and based on verified self-assessment. Cyber Essentials Plus adds technical verification.
Information becoming accessible to an unauthorised party. Disclosure threatens confidentiality, even if the original information is unchanged.
How far a system, service or piece of information can be seen or reached by others, especially from the internet.
The four classroom options for responding to a risk: Treat (mitigate), Transfer (shift specified consequences), Tolerate (accept with authority) and Terminate (stop the activity).
How serious the consequences of an event would be for the organisation and the people affected.
Risk assessed before the controls being evaluated are taken into account.
How probable it is that a defined event will happen over a stated period.
Authentication that requires two or more different types of factor, such as something you know and something you have.
Applying updates from a software vendor that fix known vulnerabilities or other flaws.
A document that sets organisational rules and expectations, defining what is and is not permitted.
The risk that remains after considering the demonstrated effectiveness of controls.
Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.
How much risk an organisation is willing to accept in pursuit of its objectives.
The maximum loss or disruption an organisation can withstand.
The person with the authority and accountability to manage a particular risk and to accept what remains.
A record of identified risks with their assessment, treatment, owner, residual rating and review date.
The threshold beyond which action or escalation becomes necessary.
A potential cause of harm, such as an attacker seeking unauthorised access.
A weakness that a threat may exploit.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.