IT And Cybersecurity Risk Management

Why a Small Risk Word Can Cause a Big Business Decision

What would happen if your payment system stopped working for four hours, or if someone copied customer information from your computer? The event matters, but the decision you make before it happens depends on three simpler questions: How likely is it? How much damage would it cause? What do you still not know?

Those questions turn the word “risk” into something you can manage. Without them, a business may spend money on a minor problem while missing a serious weakness. A gym might replace an old office monitor while leaving its membership system open to anyone who knows the shared password. A plumbing company might buy extra tools for a rare storm but fail to protect the laptop that holds invoices and customer addresses.

The Plain-Risk Compass gives you a practical way to describe each concern using likelihood, impact, and uncertainty. After working through it, you can explain a risk in plain language, compare different risks, choose a sensible action, and record what would change your decision. Ask yourself: could another person in your business understand the risk from your description without needing technical knowledge? If not, the description needs work.

The Plain-Risk Compass: Likelihood, Impact, and Uncertainty

IT risk means the possibility that a problem involving technology could prevent your business from reaching a goal. The goal might involve serving customers, collecting payment, paying staff, protecting private information, or meeting a promise made to a customer. Cybersecurity risk means the part of IT risk connected to attacks, unauthorized access, harmful software, stolen information, or deliberate misuse.

A risk is not the same as a problem that already happened. If your card reader has stopped working, that is an incident. The risk is that it may stop again during a busy Saturday. If an employee already clicked a harmful link, that is an incident. The risk is that the same account may still allow an attacker to enter. This difference matters because risk management helps you act before damage grows, while incident response helps you handle an event already underway.

The Plain-Risk Compass uses three questions:

1. What could happen? State the event in clear terms. “A customer’s payment information could be exposed through the online booking account” gives you something you can check. “Cybersecurity is weak” does not.

2. How likely is it? Estimate the chance using evidence such as past failures, missing updates, shared passwords, or the number of people with access. Use a simple scale: low, medium, or high.

3. What would it affect? Describe the impact if the event happens. Consider lost sales, recovery costs, privacy harm, missed deadlines, damaged trust, or safety problems. Again, use low, medium, or high.

4. What do we not know? Record uncertainty. You may not know whether old accounts still work, whether backups can restore files, or whether a software provider protects your data properly.

Likelihood describes chance, not certainty. A high-likelihood risk may involve a repeated warning, such as a payment computer crashing every few weeks. A low-likelihood risk may involve a rare event, such as a fire destroying the only computer that stores appointment records. Do not call a risk “low” just because it has never happened. A locked door that you never test may still fail.

Impact describes the result, not the drama of the event. A short internet outage may have low impact if staff can write orders down and enter them later. The same outage may have high impact for an online-only business that cannot accept orders or answer customers. To estimate impact, ask what stops, who feels the effect, how long the disruption lasts, and what it costs to recover.

Uncertainty tells you how dependable your estimate is. You might rate likelihood as medium and uncertainty as high because you have no record of failed login attempts and do not know which former workers still have access. That does not make the risk unimportant. It tells you to gather information before making a confident decision. The basic description might read: “An old staff account could still access the booking system; likelihood medium, impact high, uncertainty high.”

The key takeaway is simple: describe the event first, then judge its chance, its effect, and the gaps in your knowledge. That sequence keeps guesses from hiding inside vague labels.

Applying the Compass to a Booking System

Consider a small fitness studio that uses an online booking system for classes, customer contact details, and monthly payments. The owner wants to decide whether to spend a Saturday reviewing access and backup arrangements.

Use these steps:

1. Name the business goal. The studio needs to accept bookings, protect customer information, and collect monthly payments....