CHAPTER 1Risk Management FundamentalsCopyright © 202

CHAPTER 1
Risk Management Fundamentals
Copyright © 2022 by Jones & Bartlett Learning, LLC an Ascend
Learning Company. www.jblearning.com.
Learning Company. www.jblearning.com
Learning Objective(s) and Key Concepts
Describe the components of and approaches to effective risk
management in an organization.
Risk and its relationship to threat, vulnerability, and asset loss
Classifying business risk in relation to the seven domains of a
typical IT infrastructure
Risk identification techniques
Risk management process
Strategies for handling risk
Learning Objective(s)
Key Concepts
What Is Risk?
Risk: The likelihood that a loss will occur; losses occur when a
threat exposes a vulnerability that could harm an asset
Threat: Any activity that represents a possible danger

Vulnerability: A weakness
Asset: A thing of value worth protecting
Loss: A loss results in a compromise to business functions or
assets.
Tangible
Intangible
Risk-Related Concerns for Business
Compromise of business functions
Compromise of business assets
Driver of business costs
Profitability versus survivability
Threats, Vulnerabilities, Assets, and Impact
Threats can be thought of as attempts to exploit vulnerabilities
that result in the loss of confidentiality, integrity, or availability
of a business asset:
Confidentiality: Preventing unauthorized disclosure of

information
Integrity: Ensuring data or an IT system is not modified or
destroyed
Availability: Ensuring data and services are available when
needed
Vulnerabilities
A vulnerability is a weakness
A loss to an asset occurs only when an attacker is able to
exploit the vulnerability
Vulnerabilities may exist because they’ve never been corrected
Vulnerabilities can also exist if security is weakened either
intentionally or unintentionally
Assets
Tangible value is the actual cost of the asset:
Computer systems—Servers, desktop PCs, and mobile
computers

Network components—Routers, switches, firewalls, and any
other components necessary to keep the network running
Software applications—Any application that can be installed on
a computer system
Data—Includes large-scale databases and the data used and
manipulated by each employee or customer
The intangible value cannot be measured by cost, such as client
confidence or company reputation:
Future lost revenue—Any purchases customers make with
another company are a loss to the company
Cost of gaining the customer—If a company loses a customer,
the company’s investment is lost
Customer influence—Customers commonly share their
experience with others, especially if the experience is
exceptionally positive or negative
Reputation—One customer’s bad experience could potentially
influence other current or potential customers to avoid future
business transactions
Impact
Very High

Indicates multiple severe or catastrophic adverse effects
High
Indicates a severe or catastrophic adverse effect
Moderate
Indicates a negligible adverse effect
Low
Very Low
Indicates a serious adverse effect
Indicates a limited adverse effect
Classify Business Risks
Risks posed by people:
Leaders and managers
System administrators
Developer
End user
Risks posed by a lack of process:
Policies

Standards
Guidelines
Risks posed by technology:
User Domain
Workstation Domain
LAN Domain
LAN-to-WAN Domain
WAN Domain
Remote Access Domain
System/Application Domain
Classify Business Risks (Cont.)
Seven Domains of a Typical IT Infrastructure
Risk Identification Techniques
Identify threats

Identify vulnerabilities
Estimate impact and likelihood of a threat exploiting a
vulnerability
Identifying Threats and VulnerabilitiesComponentType or
SourceThreatsExternal or internal
Natural or man-made
Intentional or accidentalVulnerabilitiesAudits
Certification/accreditation records
System logs
Prior events
Trouble reports
Incident response teams
Balancing Risk and Cost
Consider the cost to implement a control and the cost of not
implementing the control
Spending money to manage a risk rarely adds profit; important
point is that spending money on risk management can help
ensure a business’s survivability
Cost to manage a risk must be balanced against the impact value
Reasonableness: “Would a reasonable person be expected to
manage this risk?”

Balancing Risk and Cost (Cont.)Low Impact
(0%—10%)Medium Impact
(11%—50%)High Impact
(51%—100%)High-threat likelihood—100% (1.0)10 × 1 = 10 50
× 1 = 50 100 × 1 = 100Medium-threat likelihood—50% (.50)10
× .50 = 5 50 × .50 = 25 100 × .50 = 50Low-threat likelihood—
10% (.10)10 × .10 = 1 50 × .10 = 5100 × .10 = 10
A threat-likelihood-impact matrix.
Risk Management Process
Risk Management
Risk: Probability of loss
Vulnerability: System weakness
Threat: Potential harm
Risk Management Process (Cont.)

Assess risks
Identify risks to manage
Select controls
Implement and test controls
Evaluate controls
Cost-Benefit Analysis
Principle of Proportionality
Cost-benefit analysis (CBA)
Cost of control
Projected benefits

The amount spent on controls should be proportional to the risk
Helps determine which controls, or countermeasures, to
implement
Profitability Versus Survivability
Out-of-pocket costs
Lost opportunity costs
Future costs
Client and stakeholder confidence
Total cost of security
Risk-Handling Strategies

Various Techniques of Risk Management
Avoiding
Sharing or transferring
Mitigating
Accepting
Residual Risk
Summary
Risk and its relationship to threat, vulnerability, and asset loss
Classifying business risk in relation to the seven domains of a
typical IT infrastructure
Risk identification techniques
Risk management process
Strategies for handling risk
10/8/2020

21
Healthcare Cost and Utilization Project (HCUP)
Virtual Field Trip (1:57):
https://www.youtube.com/watch?v=m2xytHIm3K0
Started in 1988
Our most comprehensive source of hospital care data
Data collected from these types of encounters:
in-patient stays
ambulatory surgery and services visits
emergency department
Includes clinical and nonclinical data (diagnoses and
procedures, discharge status, patient demographics, and
charges) for all patients, regardless of payer (e.g., Medicare,
Medicaid, private insurance, uninsured)
Enables researchers, insurers, policymakers and others to study
health care delivery and patient outcomes over time
Family of databases, software tools and related products
Data is used for research on health policy issues:
cost and quality of health services
medical practice patterns
access to health care programs
outcomes of treatments at the national, State, and local market
levels.
Virtual Field Trip (20:27):
https://www.youtube.com/watch?v=n7aZLAMJDRw

Helpful Resources
Chapter 8: Secondary Data Sources
AHRQ Views: Watch 3 videos on this page!
https://www.ahrq.gov/news/blog/ahrqviews/health-data-
community-datapalooza.html
Review this article: Great explanation of how HCUP collects
data.
https://www.businessinsider.com/most-expensive-health-
conditions-hospital-costs-2018-2
The average hospital stay in the US costs just over $10,700,
based on an analysis of recent data from the Healthcare Cost
and Utilization Project (HCUP).
In total, there were 35.4 million hospital stays with an
aggregate cost of $384.5 billion.
HCUP Infographics!
HCUP Statistical Briefs:
https://www.hcup-us.ahrq.gov/reports/statbriefs/statbriefs.jsp
HCUP Infographics:
https://hcup-us.ahrq.gov/reports/infographics.jsp
More Helpful Resources
Healthcare Cost and Utilization Project:
U.S. Department of Health & Human Services
http://www.ahrq.gov/research/data/hcup/
https://www.hcup-us.ahrq.gov/

Research so that you understand
what the H-CUP program is all about!
Interactive Tutorial:
https://www.hcup-
us.ahrq.gov/HCUP_Overview/HCUP_Overview/index.html
State Information:
https://www.hcup-us.ahrq.gov/partners.jsp
Unit 6 Assignment
Healthcare Cost and Utilization Project:
U.S. Department of Health & Human Services
http://www.ahrq.gov/research/data/hcup/
** https://www.hcup-us.ahrq.gov/ **
Create a 1-page informational flyer for the Healthcare Cost and
Utilization Project.
You should use Microsoft Word or Microsoft Publisher to create
your advertisement. Include the following information:
What is the HCUP Program?
There are several different database tools used in this program.
Name at least 4 database tools and give a summary for each.
Indicate on the advertisement if your state participates in the
HCUP program. If your state does participate in the program,
provide the contact information for the person listed.
Looking Ahead: Unit 6 Assignment
National (Nationwide) Inpatient Sample (NIS):
is the largest publicly available all-payer hospital inpatient care
database in the United States. Researchers and policymakers use

NIS data to identify, track, and analyze trends in health care
utilization, access, charges, quality, and outcomes.
Kids' Inpatient Database (KID):
is composed of hospital inpatient stays for children and is
specifically designed to allow researchers to study a broad
range of conditions and procedures related to children's health.
Researchers and policymakers can use KID data to identify,
track, and analyze health care utilization, access, charges,
quality, and outcomes.
Nationwide Emergency Department Sample (NEDS):
captures information on emergency department (ED) visits that
do not result in an admission as well as ED visits that result in
an admission to the same hospital. The NEDS enables analyses
of ED utilization patterns and supports public health
professionals, administrators, policymakers, and clinicians in
their decision making regarding this critical source of care.
State Emergency Department Databases (SEDD):
are a set of databases that capture discharge information on all
emergency department visits that do not result in an admission.
The SEDD combined with SID discharges that originate in the
emergency department are well suited for research and policy
questions that require complete enumeration of hospital-based
emergency departments within market areas or States.

CHAPTER 1Risk Management FundamentalsCopyright © 202

Recommended

Recommended

More Related Content

Similar to CHAPTER 1Risk Management FundamentalsCopyright © 202

Similar to CHAPTER 1Risk Management FundamentalsCopyright © 202 (20)

More from EstelaJeffery653

More from EstelaJeffery653 (20)

Recently uploaded

Recently uploaded (20)

CHAPTER 1Risk Management FundamentalsCopyright © 202