What is the Difference Between Risk Analysis and Risk Evaluation?
In the ISO 31000 risk management framework, risk analysis and risk evaluation are distinct, sequential steps in the overall risk assessment process. Understanding the difference is essential for using DecipherRisk effectively in a healthcare cybersecurity context.
Risk Analysis: Understanding the Risk
Purpose: Risk analysis is the process of understanding the characteristics of a risk, including its causes, consequences, likelihood, and existing controls.
Key Activities:
- Identifying consequences (e.g., patient safety, compliance fines, data integrity failures).
- Estimating likelihood using scenarios, historical data, or simulation.
- Identifying root causes (e.g., misconfigured access controls, unpatched vulnerabilities).
- Reviewing effectiveness of existing controls (e.g., MFA, network segmentation, EDR).
- Calculating/estimating the level of risk, such as Value at Risk or FAIR-based estimates in DecipherRisk.
ISO Quote: "The purpose of risk analysis is to understand risk. This includes understanding the consequences to objectives, their likelihood, causes, and existing controls… and where appropriate, obtaining a level of risk." — ISO 31000:2018 Practical Guide, §4.5.3
Example: A security analyst uses the Risk module to model a ransomware threat. They enter the asset (e.g., EHR system), impact categories (e.g., financial reporting delay, patient safety, compliance exposure), and likelihood factors to calculate an estimated annualized loss exposure using the Open FAIR model.
Risk Evaluation: Judging Significance
Purpose: Risk evaluation is the process of comparing the results of analysis against defined risk criteria to decide whether the risk is significant and what to do about it.
Key Activities:
- Comparing each risk’s impact and likelihood against organizational risk criteria (e.g., thresholds for financial loss, patient safety tolerance).
- Determining risk requirements: treatment, acceptance, or escalation.
- Prioritizing risks for mitigation based on strategic and operational impact.
- Supporting resource allocation and decision-making for mitigation or acceptance.
ISO Quote: "The results of risk analysis can be compared with risk criteria to determine the significance of risk. An understanding of risk and its significance is relevant to any decision, including whether to treat a risk or not." — ISO 31000:2018 Practical Guide, §4.5.4
Example: A CISO views the executive risk dashboard. One risk—unauthorized access to clinical imaging systems—has a quantified loss of $1.2M and impacts multiple domains (patient safety, regulatory compliance). Based on the hospital's predefined thresholds, this risk exceeds the acceptable criteria. It is flagged for mandatory treatment and assigned to the infrastructure team via an Action Plan.
How Risk Analysis and Risk Evaluation Work Together
Step | Purpose | Questions Answered |
|---|---|---|
| Risk Analysis | Understand the risk | What is the risk? How bad could it be? How likely is it? |
| Risk Evaluation | Judge its significance and decide what to do | Is the risk acceptable? Do we need to act? Who needs to know? |
In Practice with DecipherRisk
- Risk Analysis is done primarily in the Risk and Issue modules, where analysts estimate loss exposure and examine contributing factors.
- Risk Evaluation is conducted using risk criteria defined in the Scope, Context, and Criteria phase. Evaluation happens in both the dashboard and reporting outputs, where risks are prioritized, escalated, or accepted based on thresholds.
Risk evaluation is where decisions are made. Risk analysis is what informs those decisions.
Related Resources
- Core Modules and Workflow User Guide
- Pro Tip: Core Workflow Triage Process
- Improving Decisions with DecipherRisk™️ Cost-Benefit Analysis (Scenario Cloning and Comparisons Features)