Risk assessment concepts, standards, and frameworks are structured bodies of knowledge — principles, methodologies, and governance models — that organizations use to systematically identify, analyze, evaluate, and communicate risks. At the framework level, this means understanding four major codified systems: ISO 31000:2018 (global, principles-based standard), COSO ERM 2017 (enterprise strategy-integration model), NIST RMF SP 800-37/800-39 (tiered federal and critical-infrastructure model), and ISO/IEC 27005:2022 (information-security risk extension) — and knowing how to select, compare, and integrate them in practice. A risk assessment framework is not a checklist or a one-time audit tool; it is a governance operating system that shapes how risk decisions are made across an enterprise over time.
Where it stops · what it isn't
- —IS: Comparative, governance-oriented understanding of COSO ERM, ISO 31000, NIST RMF, and ISO/IEC 27005 as distinct but interoperable systems with defined scopes, principles, and structures
- —IS: Selection criteria, integration logic, and maturity considerations for matching a framework to an organizational context
- —IS: Governance constructs embedded in frameworks — risk appetite, risk tolerance, the Three Lines Model, risk ownership, and reporting hierarchies
- —IS NOT: Deep-dive into a single framework's technical implementation steps (covered in operational risk management competencies)
- —IS NOT: Foundational definitions of risk terms such as 'likelihood' or 'impact' (covered in prerequisite LOD 400 content)
- —IS NOT: Regulatory compliance checklists (HIPAA, PCI-DSS, SOX) — those are compliance instruments that interact with risk assessment frameworks but are not frameworks themselves
- —IS NOT: Incident response or business continuity planning, even though ISO 22301 uses risk assessment outputs as inputs
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
REQUIREScrisc-d1-governance-foundational-risk-conceptscrisc-d1-governance-organizational-strategy-and-objectives
PART OFcrisc-domain1-it-risk-identification
ENABLEScrisc-d2-it-risk-assessment-quantitative-qualitative-methodscrisc-d3-risk-response-and-mitigationcrisc-d4-risk-monitoring-and-reporting
RELATED TOcrisc-d1-governance-three-lines-modelcrisc-d1-governance-risk-appetite-and-tolerance
CONSTRAINScrisc-d2-risk-assessment-methodology-selection