One of the first questions I ask when working with an organization is “Why are you interested in making FAIR (Factor Analysis of Information Risk) a part of your standard risk management practice?”

The answer is different for every client, and that truly highlights the value of risk quantification.

We can apply risk quantification to a number of areas in major industry sectors. Your organization may want to assess the risks associated with a vendor through your third-party risk management program, or maybe you want to understand the impact of recently identified compliance or regulatory gaps. Or possibly there is a need to justify the cost of a new security investment or process improvement. Whatever your ‘why’, risk quantification could be part of the solution. You may also find that your risk quantification journey starts with your most critical use case but, over time, scales to meet additional needs across the business.

Making investments and prioritization of project decisions can be challenging for businesses large and small. With competing priorities and goals, it can feel impossible to gain alignment across the organization. But what if your goals and understanding were aligned? How would that change the conversation?

By speaking a common language, dollars and cents, you are able to bridge the gap and bring alignment across the organization. Risk quantification can also be leveraged in organizations at all levels of risk maturity. Because of these factors, it becomes a universally accessible way to assess and understand risks across the business.

It’s also important to understand that the ‘why’ is often different within different levels of the same organization. If you’re speaking with IT security professionals, they may be more concerned with which tool or software will help them best protect the environment. But if you’re working with a chief information security officer (CISO) or other C-level executives, they may be focused on the larger picture of protecting the brand and business value.

I recall a previous client engagement where the ‘why’ differed across the organization. The CISO needed to understand how to communicate financial risk information to the board and leadership as part of strategic and budget planning, but the IT security team wanted information around prioritizing risks so they could determine where to make improvements. The scenarios that were analyzed for this client allowed us to meet the needs of both parties. We quantified risks and prioritized the results so that the IT security team could create a proposal, and we provided reporting tools for the CISO to share the results with the board and leadership.

Because the FAIR methodology takes into account both threat event frequency and loss magnitude when quantifying risk, it provides the business with valuable information that can be used to make informed decisions. When working with FAIR, we are looking to answer the question: “How often do we think this will happen and, when it does, how big will the loss be?” Once we can answer these questions, we are able to make better decisions on how to mitigate risks. This also provides a level of understanding that resonates across all levels of the organization.

Understanding your client’s ‘why’ and goals before you get started will give way to clarity and direction to your FAIR engagement.