What to do at this stage
- 01
Describe each scenario clearly enough to identify its causes, event and consequences.
- 02
Evaluate the controls that actually operate and record the basis for crediting them.
- 03
Document the current risk, uncertainty and findings for the risk owner to consider.
Questions to work through
- What could happen, and through which pathway?
- Which controls are operating effectively?
- What evidence would change this assessment?
For unauthorised access to a critical room, examine permissions, door behaviour, monitoring and response. A written access policy alone does not establish that these controls work.
A common trap
Treating planned controls as already effective can understate the current risk.
When the work needs to return
Suggested resources
Selected for their likely use at this stage. Resource associations are guidance, not a compliance crosswalk.
ISO 31000 Risk Management Process — One-Page Guide
Keep the risk management process in view while structuring your assessment.
View in the SRMBOK shopThe Bow-Tie Field Kit
Support a bow-tie workshop and review the resulting analysis.
View in the SRMBOK shopRisk Register — Template 13.1
Organise assessment findings in a consistent risk register.
View in the SRMBOK shopSRMBOK Guide to ChatGPT Prompt Engineering
Use and adapt prompts for risk identification, assessment, stakeholder engagement and treatment planning.
View in the SRMBOK shopRisk Thinking for Domestic and Family Violence Practice (an SRMBOK Guide)
Risk thinking for domestic and family violence practitioners, covering uncertainty, controls and defensible decisions. A companion to mandated assessment processes.
View in the SRMBOK shopThe Risk Bow-Tie Method eBook
Learn the bow-tie method through its nine elements, a factory-fire example and a workshop outline.
View in the SRMBOK shopSecurity Risk Assessment Process Flow Template
An editable Excel flowchart covering nine risk-management steps, with responsibilities, a legend and adaptable scope, context and criteria.
View in the SRMBOK shopSRMBOK Template 13.2 Risk Register
Record risks, categories, treatment options, risk levels and monitoring comments in an editable Word register.
View in the SRMBOK shopA Guide to the Risk Management Body of Knowledge
A free illustrated RMBOK primer covering risk principles, frameworks and processes, with risk statements, bow-tie analysis, control-review questions and lessons from major events.
View in the SRMBOK shopRisk Assessment Template
An editable Word security risk assessment report template, with guidance and worked examples from scope and context through risk analysis and treatment recommendations.
View in the SRMBOK shopSRMBOK Guide to Red Teaming and Scenario Modelling
Understand scenario modelling and futures analysis as inputs to security risk assessments and changing-threat reviews.
View in the SRMBOK shopSRMBOK Guide to AI for Risk Practitioners
Practical guidance on AI use, information handling, verification and the evidence behind professional risk judgements.
View in the SRMBOK shopSRMBOK Guide to Managing Explosives Threats
Understand explosives threats and an integrated approach to assessing, mitigating and managing related incidents.
View in the SRMBOK shopSRMBOK Guide to the Risk Management Process
A 16-page guide and one-page diagram explaining risk-management actions, inherent, current and residual risk, layered controls and proportionate assessments.
View in the SRMBOK shopSRMBOK Guide to Intellectual Assets
Guidance on protecting intellectual assets, with attention to research environments, organisational culture and information risks.
View in the SRMBOK shopSRMBOK 30-Day Risk Assessment Delivery Kit
Six files to plan, run and document an assessment: a Start Here guide, assessment guidance, editable Word templates, workshop slides and a findings-handover presentation.
View in the SRMBOK shopSRMBOK Guide to Insider Threat Management Programs
Guidance on establishing an insider threat programme, from assessment and policies to awareness, detection and response.
View in the SRMBOK shopSRMBOK Risk Assessment Spreadsheet
An Excel risk register calculating inherent, current and residual risk, with a heat map, barrier map, treatment tracking, review dates and a one-page board pack.
View in the SRMBOK shopEnterprise Security Risk Assessment Template
Adapt a fully worked enterprise security risk assessment using a fictional corporation, with editable examples and treatment content.
View in the SRMBOK shopSRMBOK Physical Security Risk Assessment Tool
An Excel workbook with a worked physical security assessment, live risk matrix, treatment options, residual-risk targets and a reporting dashboard.
View in the SRMBOK shopKeep the whole life cycle in view
Security Risk Management Life Cycle Wall Charts
Keep the whole life cycle in view, from initiation to change and disposal.
View in the SRMBOK shopGuide to the Security Risk Management Life Cycle
The full 16-stage SRMBOK life cycle guide, with decision gates, return paths, checklists, worked examples and a diagnostic worksheet.
View in the SRMBOK shopThese practical prompts are editorial guidance for the navigator. Consult the published SRMBOK life cycle guide and charts for the full method. About this edition and its sources.