Execute Data-Driven Risk Assessments

A practical approach to assessing risk loss impact for your most severe risks.

Analyst perspective

Deliver data-driven risk assessments for superior risk-informed decision-making.

As technology, geopolitical, and regulatory risks grow in both scale and interconnectedness, boards and executives are increasingly demanding risk insights that are decision grade, not merely descriptive. Yet many organizations remain constrained by qualitative, compliance-driven risk assessments that only classify risks as high, medium, or low without articulating what those risks mean in financial or business terms. This disconnect limits leaders' ability to prioritize investments, defend risk response budgets, or clearly communicate exposure across the enterprise. In this environment, risk assessments must evolve from static reporting exercises into analytically grounded inputs for strategic decision making.

This blueprint addresses that gap by introducing a pragmatic, blended approach to risk assessment that combines the speed and consensus building value of qualitative assessments with deeper, financially grounded analysis for the most severe risks. Rather than forcing organizations into overly rigid quantitative models or data heavy frameworks that are difficult to sustain, the methodology emphasizes proportionality: use qualitative scoring to filter and focus, then apply structured estimation techniques to simulate loss impact and occurrence frequency where it matters most. By anchoring risk discussions in concepts such as single loss impact and annualized loss expectancy – expressed as ranges rather than false precision – leaders gain a more credible and transparent view of uncertainty, tail risk, and trade-offs.

Financially grounded risk insights enable CIOs, CISOs, and enterprise risk leaders to compare risks across domains, align exposures with risk appetite, and evaluate whether the cost of mitigation is justified by the reduction in expected loss.

Anubhav (Anu) Sharma
Principal Research Director, CIO Research
Info-Tech Research Group

Get familiar with risk management terminology

Where this blueprint fits in the risk process

If you are an enterprise risk management leader, this blueprint can help you to identify, assess, and measure enterprise risks to enable risk-informed decision-making.

If you are a CIO/IT Leader, this methodology can help you identify, assess, and measure technology-driven risks, which you can then bring up to enterprise leaders to ensure you have a strong data point based on which risk response decisions can be taken.

Executive summary

Your Challenge

• Many organizations remain constrained by qualitative, compliance-driven risk assessments that classify risks as high, medium, or low without articulating associated impact or costs. This makes it difficult for executives to determine appropriate funding and make strategic risk decisions.
• In today's global environment, as technology, geopolitical, and regulatory risks grow in both scale and interconnectedness, boards and executives are increasingly demanding risk insights that are decision grade, not merely descriptive.
• CIOs and executives need a blended approach to better evaluate their most severe risk exposures while balancing resource/time constraints.

Common Obstacles

• Siloed data sources and poor data quality: Leaders must contend with poor, inconsistent data records that increase difficulty in calculating losses.
• Inflexible estimation methods: Assessment methods do not leave room for range of estimation, leading to unreliable loss exposure values.
• Complex and time-consuming methods for calculating loss exposure due to risks lead to a bias toward qualitative assessments, which are less useful for financial and strategic decision-making.
• Resource constraints result in limited risk resources.
• Limited risk knowledge means organizations struggle to explain risk in financial/business value terms.

Info-Tech's Approach

Data-driven risk assessment is a practical approach to assessing risk loss impact for your most severe risks.

• Identify or review risks and create or update your risk register.
• Conduct a qualitative assessment of risks and filter the list down to your most severe risks.
• Conduct more-in-depth financial assessments for prioritized risks.
• Communicate results to risk owners and evaluate next steps in terms of risk response decisioning.

Info-Tech Insight

CIOs/risk leaders who cannot quantify their greatest risks in dollars will struggle to influence investment decisions, defend budgets, or earn a seat at the strategy table.

Risk leaders struggle to run actionable and financially grounded risk assessments

• Most organizations rely on qualitative risk assessments (marking risks as high, medium, low), which are quicker but tend to be more subjective in terms of assessing impact and cost of risks.
• Executives in today's uncertain times (see World Uncertainty Index) are seeking more details when making risk response investment decisions, especially for their most severe risks.
• This requires a more quantitative analysis of risks – which is more complex and resource intensive but provides better insights for decision-making.
• Hence, a blended approach between quantitative and qualitative can serve organizations well, which is what we advise in this blueprint.

Many enterprises rely primarily on qualitative assessments because they are faster and cheaper, even though they are subjective and lack fact-based financial grounding.

– ISACA, 2022

World Uncertainty Index (1990Q1 to 2025Q1)

Source: The World Uncertainty Index is a measure that tracks uncertainty across the globe by text mining the country reports of the Economist Intelligence Unit. The index is available for 143 countries.

This research is designed to help both technology and enterprise risk leaders run data-driven risk assessments

Leaders face several hindrances in conducting data-driven risk assessments

Explore Info-Tech's approach to executing data-driven risk assessments

Insight summary

A pragmatic, blended risk assessment approach that combines the speed and consensus building value of qualitative assessment with deeper, financially grounded analysis for the most severe risks can help CIO/risk leaders make better risk decisions.

CIOs/risk leaders who cannot explain risk in business terms will struggle to influence investment decisions, defend budgets, or earn a seat at the strategy table.

Capturing risks across domains in a consistent taxonomy enables later aggregation and comparison.

Well-executed work in Phase 1 of this blueprint turns the risk register into a decision-ready artifact, not just a compliance document.

Qualitative scoring is not about precision – it is about building organizational consensus on what truly matters.

Phase 2 acts as a filter that preserves analytical effort – only risks that pass this screen deserve the cost and complexity of a further deep dive.

Quantification transforms risk from an abstract concern into a comparable economic trade-off.

Phase 3 reveals mismatches between perceived and actual risk drivers – for example, that financial exposure is driven more by prolonged downtime or regulatory penalties than by one-time remediation costs. It also surfaces data gaps and other concerns.

Risk insights only create value when they are translated into ownership, decisions, and action.

Effective communication at this stage reframes risks as choices – accept, mitigate, transfer, avoid, or exploit – rather than abstract exposures.

Developing the discipline of moving risks forward through the entire data-driven risk assessment outlined in this blueprint without losing context, intent, or ownership will help you make more risk-aware decisions.

Blueprint deliverables

Each step of this blueprint is accompanied by supporting artifacts to help you accomplish your goals:

Risk Assessment Workbook

This structured Excel workbook helps you work through the activities throughout the blueprint and document your results.

Key deliverable:

Risk Owner Communication Template

This deck will communicate the findings of the risk assessment exercise to risk owners for further decisioning

Measure the value of this research

Be ready to run better risk assessments whose results can be used to secure funding for risk responses.

• This research helps organizations develop a blended approach to risk assessment in which their most severe risks across a wide range of domains — e.g. Cybersecurity, Infrastructure, AI, data, Operations – can be evaluated in financial terms for better decision-making.
• Use this research to:
• Evaluate the current state of the organization's risk register and taxonomy.
• Conduct a qualitative assessment of risk events to filter down to most severe risks.
• Conduct a data-driven financially grounded risk assessment for better decisioning.
• Communicate loss impact to risk owners in a clear and concise format.

Most organizations would need to spend a great deal of money and resources to create and execute a blended risk assessment method.

Based on similar research and development efforts, we estimate that most organizations would take months to prepare a blended risk assessment methodology without our resources. That's nearly 65 hours per person multiplied by the number of people involved in researching and gathering data, conducting meetings and documenting findings for a total cost of thousands of dollars. Improve your success rate and reduce your effort by using Info-Tech's methodology, developed through the combined insights of seasoned Info-Tech experts as well as external industry viewpoints.

Value of this blueprint = Reduced effort and cost to develop a blended risk assessment method versus developing a similar document without Info-Tech's methodology and resources.

Example risk assessment journey: Acme Inc.

Company Profile:

Acme Inc. is a global semiconductor manufacturer specializing in advanced sensor technologies for automotive (original equipment manufacturer [OEM]).

Annual Revenue: $500 million
Employees: 1,500
Manufacturing facilities: US, Canada, UK, China

The Challenge:

Acme relies on a highly automated production environment, globally integrated enterprise resource planning (ERP), and cloud based lifecycle management systems that handle design files, engineering data, and intellectual property (IP). Amid rising geopolitical tensions, growing regulatory pressures, and a spike in cyberattacks targeting semiconductor IP, Acme faces mounting cyber and operational risks. Recently, Acme experienced a material data breach involving unauthorized access to its engineering design repository, which stores core sensor IP, product roadmaps, and manufacturing process specifications.

Forensic investigation indicated the intrusion likely persisted undetected for several weeks, with evidence of exfiltration of confidential design assets. The breach immediately elevated concerns across risk domains — cybersecurity, operational continuity, regulatory exposure, reputation, and potential loss of competitive advantage.

Executives realized that the company's current risk register understated interdependencies across its global operations and did not quantify financial exposure in a clear, decision ready manner. Recognizing the need to modernize the company's enterprise risk management (ERM) and IT risk practices, Acme's CIO, CISO, and CRO jointly sponsor a comprehensive risk assessment initiative grounded in Info Tech's blended (qualitative + financial) methodology. Their objectives are to rebuild confidence in the organization's ability to identify risks across business and technical domains; build consistent qualitative scoring scales; quantify financial exposures using single loss impact (SLI), occurrence frequency (OF), and annualized loss expectancy (ALE); and justify investments in cybersecurity, operational resilience, and IP protection.

Follow Acme's risk assessment journey throughout this blueprint:

Phase 1: Identify or Review Key Risks

Phase 2: Conduct a Qualitative Assessment of Risks

Phase 3: Conduct a Deeper-Dive Financial Assessment for Prioritized Risks

Phase 4: Communicate Results and Evaluate Next Steps

Phase 1

Identify or Review Key Risks

Phase 1

1.1 Assess completeness of the risk register
1.2 Confirm risk taxonomy
1.3 Identify risks across domains

Phase 2

2.1 Develop qualitative risk impact and likelihood scales
2.2 Evaluate listed risk events qualitatively and identify prioritized risk events for further deep dive

Phase 3

3.1 Identify key factors and estimate single event impact
3.2 Estimate occurrence frequency
3.3 Arrive at ALE impact

Phase 4

4.1 Develop next steps and recommendations
4.2 Build risk owner communication deck

This phase will produce the following outcomes:

• Filled-in risk register capturing a comprehensive view of the risk environment and risk events

This phase involves the following participants:

• For enterprise risk: CRO, business unit heads, internal audit, risk committee, risk SMEs
• For IT risk: CIO, CISO, business unit heads, internal audit, IT risk committee, risk SMEs

1.1 Assess completeness of risk register

Assess your readiness for running data-driven risk assessments by first reviewing your risk register and validating your risk taxonomy

This blueprint is part of a multistep risk journey. Before you jump into Phase 1, consider:

1. Is your risk register up to date with key risks identified and documented?
2. Are you using a common risk taxonomy?
3. Have you documented your risk responses?
4. Do you have a view of controls effectiveness?
5. Is your organization's risk appetite well understood and incorporated into your risk outlook?

YES

Proceed to Phase 2

No

Continue with Phase 1

1.1 Assess completeness of risk register

1.1.1 Assess completeness of the risk register

30 minutes

On your own or with the assistance of your Info-Tech representative, assess:

1. Is your risk register up to date with key risks identified and documented in the risk register?
2. Are you using a common risk taxonomy?
3. Have risk responses been documented, and do you have a view of controls effectiveness?
4. Do you understand the risk appetite of the organization, and have you incorporated that in your risk outlook?

If the answer is "yes" to all the above, you can skip to Phase 2. Otherwise, continue on to steps 1.2 and 1.3.

1.2 Confirm risk taxonomy

What is a risk taxonomy?

A risk taxonomy provides a common risk view and enables integrated risk

• A risk taxonomy is the (typically hierarchical) categorization of risk types organized by a classification scheme.
• Its purpose is to assist with the management of an organization's risk by arranging risks in a classification scheme.
• It provides foundational support across the risk management lifecycle in relation to each of the key risks.
• More material risk categories form the root nodes of the taxonomy, and risk types cascade into more granular manifestations (child nodes).
• From a risk management perspective, a taxonomy will:
• Enable more effective risk aggregation and interoperability.
• Provide the organization with a complete view of risks and how risks might be interconnected or concentrated.
• Help organizations form a robust control framework.
• Give risk managers a structure to manage risks proactively.

1.2 Confirm risk taxonomy

Example: Commonly used ERM Level 1 risk categories

Although many organizations have expanded their enterprise risk management taxonomies to address new threats, most organizations will have the following level 1 risk types:

1.2 Confirm risk taxonomy

Structuring your risk taxonomy

Do's

• Ensure your organization's values are embedded into the risk types.
• Design your taxonomy to be forward-looking and risk-based.
• Make Level 1 risk types generic so they can be used across the organization.
• Ensure each risk has its own attributes and belongs to only one risk type.
• Collaborate on and communicate your taxonomy throughout the organization.

Don'ts

• Don't develop risk types based on function.
• Don't develop your taxonomy in a silo.

A successful risk taxonomy is forward-looking and codifies the risk language most frequently used across your organization.