3.1. Risk Identification

💡 First Principle: You cannot manage a risk you haven't found, and most risk management failures are actually identification failures — the risk was real and knowable, but no one was looking in the right place.

Undetected risk is not absent risk; it is simply risk that will surface later as a surprise, usually at the worst possible time, with the organization reacting instead of having chosen its response in advance. Risk identification is the discipline of surfacing exposure before it becomes an incident, by systematically examining threats, vulnerabilities, and their combined likelihood and impact.

⚠️ Common Misconception: Risk and threat are often used interchangeably. Risk is the intersection of threat, vulnerability, likelihood, AND impact — a severe threat aimed at a well-controlled, low-value asset can still represent low risk overall.