Treating Risk

Lesson plan

Level

Beginner

Time

About 65 minutes; the steps below add up to 64

Learners list everything that could be done about an unpatchable server, and whether installing a control removes a risk, before the four Ts and residual risk are named. Predictions then precede why risk management loops, one action for each T, how to show a control made a difference, three limits on a night out and which control acts on what; checks follow the lifecycle, insurance, unread alerts, a one-hour tolerance and the register entry. The habit to build: every treatment decision names its owner, its evidence and its review date.

Objectives

• Describe the risk lifecycle as a loop
• Choose between Treat, Transfer, Tolerate and Terminate, and combine them
• Tell inherent from residual risk, and judge residual risk on evidence
• Distinguish risk appetite, tolerance and capacity
• Choose controls with clear questions and record a treatment decision with an owner

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Assessing Risk and Quantifying Impact lessons first.
• Put the four Ts in four corners of the board and add learners’ actions to each.
• The lesson takes about 64 minutes. To teach it in two parts, stop after “Risk appetite and risk tolerance”; the second part opens with “Choosing controls”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Describe the risk lifecycle as a loop
   • Choose between Treat, Transfer, Tolerate and Terminate, and combine them
   • Tell inherent from residual risk, and judge residual risk on evidence
   • Distinguish risk appetite, tolerance and capacity
   • Choose controls with clear questions and record a treatment decision with an owner

   Purpose: Learners list everything that could be done about an unpatchable server, and whether installing a control removes a risk, before the four Ts and residual risk are named. Predictions then precede why risk management loops, one action for each T, how to show a control made a difference, three limits on a night out and which control acts on what; checks follow the lifecycle, insurance, unread alerts, a one-hour tolerance and the register entry. The habit to build: every treatment decision names its owner, its evidence and its review date.

2. 1. After the assessment Think 5 min

   Purpose: Let learners generate the four kinds of response, and question installed controls.

   Ask

   • What could the organisation do?
   • Has the risk gone?

   Responses to expect

   • Isolation and replacement come first; insurance and acceptance need prompts.
   • On screen in turns: the opening question, its answer; then the question on whether the risk has gone, and its answer.

   Discussion pause: Sort suggestions into four groups before revealing.

   In the lesson window

   • Think it through: An old server that can no longer receive security updates has been assessed as a serious risk. List every kind of thing an organisation could do about it, including things that do not involve fixing the server.
   • Think it through: After a new control is installed, has the risk gone?

3. 2. Measurement and lifecycle Explain 6 min

   Purpose: Show risk management as a loop, and where treatment sits.

   Ask

   • Why a loop?
   • What comes after treatment?

   Responses to expect

   • Some say “done”.
   • Diagram: step through the six stages; before each, ask what must happen next for the customer-database risk.
   • On screen in turns: the opening question, its answer; then dealing with a risk is a loop; the lifecycle, one stage at a time; the diagram’s stages one at a time; the check question on what comes next, and its answer; review feeds back into the loop; a useful decision record.

   In the lesson window

   • Think it through: Why is dealing with a risk a loop rather than a single job that ends when a control is installed?
   • Check your understanding: Controls have been chosen and put in place for the database risk. Which stage of the lifecycle comes next?

4. 3. Risk treatment options Predict 9 min

   Purpose: Name the four Ts and work through the legacy server.

   Ask

   • One action for each T?
   • What has insurance changed?

   Responses to expect

   • Transfer is often taken to move accountability.
   • On screen in turns: the opening; then the legacy-server scenario; the question on a server that cannot be patched, and its answer; the four Ts for the legacy server, with what still needs attention held back; what still needs attention; combining the options; the check question on buying insurance, and its answer; what transfer does not do.

   Misconceptions to challenge

   • A learner may believe: “Transferring a risk makes it someone else’s problem.” Respond: Some financial consequences move; accountability and the weakness stay.
   • A learner may believe: “Accepting a risk means ignoring it.” Respond: It is a recorded decision by someone with authority, with a review date.

   Discussion pause: The “what still needs attention” column is held back: for each T, ask what could still go wrong before revealing it.

   In the lesson window

   • Think it through: The legacy server cannot be patched. For each of the four Ts, suggest one concrete action.
   • Check your understanding: The organisation buys insurance against a breach involving the legacy server. What has changed?

5. 4. Inherent and residual risk Predict 9 min

   Purpose: Define inherent and residual risk and reassess the database scenario with evidence.

   Ask

   • Which two assessments are needed?
   • Does an unread alert count?

   Responses to expect

   • “High becomes low” is the default expectation.
   • On screen in turns: the opening question, its answer; then inherent and residual risk; reassessing the database scenario, starting with the initial exposure; applying controls; gathering evidence; reassessing likelihood and impact; comparing with the criteria; the check question on alerts nobody reads, and its answer; no automatic high-to-low step; comparing residual risk with tolerance.

   Misconceptions to challenge

   • A learner may believe: “Installing a control removes the risk.” Respond: Residual risk depends on evidence; rarely zero.

   To go further

   • What evidence would show that a permissions review actually worked?

   In the lesson window

   • Think it through: You want to show that a set of controls made a difference to a risk. Which two assessments would you need, and what must be the same about them?
   • Check your understanding: Monitoring software has been installed, but nobody reads its alerts. Should the residual assessment count it as effective?

6. 5. Risk appetite and risk tolerance Predict 9 min

   Purpose: Distinguish appetite, tolerance and capacity, with the startup, the bank and the one-hour threshold.

   Ask

   • Are the three night-out numbers the same?
   • May the team wait for the hour?

   Responses to expect

   • Tolerance and capacity are commonly merged.
   • On screen in turns: the opening question, its answer; then appetite, tolerance and capacity; the three compared, with the question to ask held back; the question to ask for each; organisational context; a measurable disruption threshold; the check question on twenty minutes in, and its answer; what the hour is not; two prompts to keep them apart.

   Misconceptions to challenge

   • A learner may believe: “Risk tolerance is how much we can survive.” Respond: That is capacity; tolerance is a chosen limit for acting.

   If the explanation does not land: Use a phone data plan: what you want to use, when you get a warning, and the most you could pay.

   In the lesson window

   • Think it through: Think about spending on a night out. How much would you like to spend, how far over that before you stop, and how much could you lose without real trouble? Are those the same number?
   • Check your understanding: A service has a tolerance of one hour of disruption before escalation. Twenty minutes into an outage, may the team ignore it until the hour is up?

7. 6. Choosing controls Predict 5 min

   Purpose: Use five questions to compare controls.

   Ask

   • Ask which acts on likelihood and which on impact.

   Responses to expect

   • Most get MFA right; backups need a moment.
   • On screen in turns: the opening question, its answer; then questions for choosing a control, starting with what it acts on; what function it serves; whether it is proportionate; what new problems it might create; how anyone will know it works; frameworks can suggest controls.

   In the lesson window

   • Think it through: Multi-factor authentication and tested backups both help against ransomware. Which acts on likelihood, and which on impact?

8. 7. Recording the decision Explain 6 min

   Purpose: Introduce the risk owner and the risk register through the fictional entry.

   Ask

   • Why could the service owner accept it?

   Responses to expect

   • The tolerance row answers it.
   • The register entry is revealed in three parts: ask what evidence would justify the residual rating, then who may accept it, before each part appears.
   • On screen in turns: the opening; then a register entry, starting with the risk and its treatment; the evidence and the residual rating; the tolerance, decision and review; the check question on who could accept, and its answer; the register makes judgement visible; an accepted risk needs an owner.

   In the lesson window

   • Check your understanding: In the register entry, why could the customer-service owner accept the residual risk?

9. 8. Apply it in a new situation Apply 4 min

   Purpose: Set up independent application, ideally on a later day.

   Ask

   • Who will try these now, and who later in the week?

   Responses to expect

   • The payroll server tests Terminate; the director tests capacity; the studio and bank test appetite.
   • On screen in turns: the opening; then the question on switching a server off tonight, and its answer; the question on a tolerance of £2 million, and its answer; the question on a studio and a bank, and its answer.

   In the lesson window

   • Apply it: A manager decides to “terminate” the risk from an old payroll server by switching it off tonight. What should be checked first?
   • Apply it: A director says, “Our risk tolerance is £2 million, because that is the most we could lose and survive.” What is mixed up?
   • Apply it: A small games studio and a bank are both deciding whether to try a new, untested payment feature. Why might their answers differ?

10. 9. Check your understanding Check 8 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • There are ten; take them in two halves if time is short.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

11. 10. What to remember Consolidate 3 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: the four Ts.

    Responses to expect

    • Treat, Transfer, Tolerate, Terminate.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

12. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • A loop, not a job.
    • Four Ts, often combined.
    • Residual risk on evidence, rarely zero.
    • Want, act, survive: appetite, tolerance, capacity.
    • Owner, reason, review date.

Consolidation

• A loop, not a job.
• Four Ts, often combined.
• Residual risk on evidence, rarely zero.
• Want, act, survive: appetite, tolerance, capacity.
• Owner, reason, review date.