Interactive Activity: Risk Assessment Exercise and Prioritisation

This activity asks you to apply the risk assessment concepts and threat knowledge from this week to a realistic scenario. You will identify threats and vulnerabilities, assess their likelihood and impact, and produce a prioritised risk register that could inform a management response. This is the kind of thinking that characterises a security-aware manager and contributes directly to your organisation’s security posture.

The Scenario

Kofi is a mid-level manager at a regional financial services organisation with offices in Ghana, Nigeria and the United Kingdom. His team of twenty-two staff handles client account management, including the processing of account applications, the updating of client records and the management of outgoing payment instructions. The team works predominantly in the office but has moved to a hybrid model in the past two years, with approximately eight staff working from home on any given day.

Kofi has been asked by his line manager to contribute to an organisational risk assessment by identifying and assessing the cyber risks associated with his team’s operations. He has gathered the following information:

• Email-based payment instructions: the team processes payment instructions received by email from clients. There is no formal verification procedure for these instructions. In the past six months, two suspicious emails purporting to be from clients have been received, requesting changes to payment account details. One was identified as suspicious by an experienced team member; the other was processed before the error was spotted and subsequently reversed at significant cost.
• Remote access via personal devices: eight staff working from home use their personal laptops to access the organisation’s client management system via a web browser. The organisation has not issued guidance on the minimum security requirements for personal devices used for work purposes.
• Shared file storage: the team uses a shared network drive to store client documents. Access to the drive is granted to all twenty-two team members, regardless of whether their role requires access to all client files. The drive is also accessible to three contractors who have been working with the team for the past year. There is no log of who has accessed which files.
• Outdated software: two workstations in the team’s office are running a version of the client management system that is more than two versions behind the current release. The IT team has been notified but has not yet scheduled the update. The vendor has confirmed that the older version contains a known vulnerability that the current release addresses.
• Incident reporting: following the near-miss with the fraudulent payment instruction, Kofi asked his team how they would report a suspected phishing email. He found that eleven of his twenty-two team members did not know the correct reporting process, and four said they would not report it at all for fear that they would be blamed if it turned out they were wrong.

Your Task: Building a Risk Register

For each of the five risks identified above, complete the following assessment. Use the risk matrix approach described in Step 3 of this week’s learning, with likelihood and impact each rated as low, medium or high:

• Risk description: describe the risk in one or two sentences, identifying the threat, the vulnerability being exploited and the potential consequence.
• Likelihood: assess whether this risk is low, medium or high likelihood. Consider how frequently similar incidents occur in organisations like this one, based on what you have learned this week.
• Impact: assess whether the impact of this risk materialising would be low, medium or high. Consider financial, reputational, operational and regulatory dimensions.
• Overall risk level: express the combined risk as low, medium, high or critical based on your likelihood and impact assessments.
• Recommended mitigation: identify one or two specific, practical mitigation actions that Kofi could reasonably take or advocate for as a manager. These should address both the technical and human or process dimensions of the risk where relevant.

Prioritisation and Reflection

Having assessed all five risks, rank them from the highest to the lowest priority for management attention. In your ranking, consider not only the severity of the risk but also the urgency of the required response and the feasibility of the mitigation. Share your risk register and prioritisation in the course discussion forum. Compare your assessment with those of other learners from different countries and sectors. You are likely to find genuine differences of opinion about relative priorities, shaped by different threat environments, regulatory contexts and organisational realities. Engaging with those differences is a valuable part of the learning process.

A Note on the Real Value of This Exercise

Risk registers like the one you have just produced are one of the most practical tools available to managers seeking to contribute to their organisation’s security. They create a shared, documented understanding of risk, provide a basis for conversations with technical teams and senior leaders, and establish a record of the management decisions taken in response to identified risks. A manager who can articulate the risks in their team’s environment clearly and specifically, and who can propose proportionate mitigations, is a significant asset to any organisation’s security programme.