OCEG GRCA Exam - Topic 2 Question 27 Discussion

Risk is defined as a measure of the desirable effect of uncertainty on objectives. According to the ISO 31000 standard, risk is 'the effect of uncertainty on objectives' which can be either positive (opportunity) or negative (threat). This definition encompasses the uncertainty that can impact the achievement of goals and objectives. It highlights that risk is not just about potential losses but also about potential gains that come from taking risks. Reference:

ISO 31000:2018 - Risk management -- Guidelines

NIST SP 800-30 Rev. 1 - Guide for Conducting Risk Assessments