Risk Identification
What is Risk Identification?
The process of finding, recognizing, and describing risks that could affect the achievement of organizational objectives.
Terms that appear alongside risk identification
Each of these is named in at least one of the same controls as risk identification. The number is how many controls name both.
- governance 14 shared controls
- risk assessment 14 shared controls
- iso 31000 10 shared controls
- audit 8 shared controls
- risk treatment 6 shared controls
- impact assessment 5 shared controls
- compliance 5 shared controls
- change management 5 shared controls
Frameworks that govern risk identification
What the standards actually require on risk identification
Requirements naming risk identification across 6 standards, quoted from the control text.
Cyber risk identification is performed at set intervals and on defined triggers such as system changes and external events.
australian-energy-sector-cyber-security-framework-aescsf::RISK-2g · RISK-2g: Risk identification repeated periodically and on triggers →Management identifies and documents the risks to development, acquisition and maintenance continuously and iteratively, starting at the onset of each project so that risk effects and mitigation options are assessed early, involving stakeholders with business p...
ffiec-it-examination-handbook::DAM-III.A · III.A Risk Identification (Development, Acquisition, and Maintenance) →Intermediate control principles for cyber risk identification, assessment, treatment and monitoring (required, with baseline, of an AI whose inherent risk is medium). Cyber risk assessments cover the risks from new products, services and relationships;
hkma-cyber-resilience-assessment-framework-c-raf::2.2.I · 2.2 Cyber risk identification, assessment, treatment and monitoring: intermediate level →In assessing risk, identify critical operations and consider the interdependence of the people, facilities, systems and third parties they need;
japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.2.2.2-D · 2.2.2.2 Risk identification and assessment: desirable actions →The FI should identify the threats and vulnerabilities applicable to its IT environment, including information assets maintained or supported by third party service providers;
monetary-authority-of-singapore-technology-risk-management-guidelines::4.2 · 4.2 Risk Identification →Where enhanced due diligence is not required, the nature and purpose of the business relationship or occasional transaction is established if the entity took reasonable steps to confirm an individual customer is who they claim to be, identified the customer's...
aml-ctf-rules-2025-australia::R6-9 · Nature and purpose of the relationship, risk identification and customers who cannot provide evidence →Questions people ask about risk identification
What is Risk Identification?
Why is Risk Identification important for compliance?
Which compliance frameworks address Risk Identification?
Where can I learn more about Risk Identification?
See how Risk Identification applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.