Common sense talk about risk heat maps and more
Only when the business impact is understood does it make sense to get into the details of which risks to which information assets should be mitigated and how.
risk evaluation
Identifying, assessing, and evaluating risk is the easy part
COSO ERM 2017 talks about strategy selection, which is a very important decision, and how you need to assess each option. The selection process includes understanding what might happen under each option (risks and opportunities in their language), weighing all the pros and cons, and then choosing the one that makes the most business sense.
