3.1. Risk Identification

💡 First Principle: You cannot manage a risk you haven't found, and most risk management failures are actually identification failures — the risk was real and knowable, but no one was looking in the right place.

Undetected risk is not absent risk; it is simply risk that will surface later as a surprise, usually at the worst possible time, with the organization reacting instead of having chosen its response in advance. Risk identification is the discipline of surfacing exposure before it becomes an incident, by systematically examining threats, vulnerabilities, and their combined likelihood and impact.

⚠️ Common Misconception: Risk and threat are often used interchangeably. Risk is the intersection of threat, vulnerability, likelihood, AND impact — a severe threat aimed at a well-controlled, low-value asset can still represent low risk overall.

Identification effort has to cover two different gaps: knowable risks that were never surfaced at all (emerging or unexamined exposure — 3.1.1), and known risks sitting in the register mis-sized because the vulnerability or assessment step was weak (3.1.2 and 3.1.3). With limited analyst time, let recent evidence decide the split: if incidents keep arriving from threats nobody anticipated, invest in intelligence and horizon scanning; if audits keep finding register ratings wrong, invest in reassessing existing entries.