How do I write a high-mark risk assessment answer in IB Computer Science?

Start by showing the examiner you can see the system like an organisation would. Identify the asset first, because “what matters” determines what counts as harm. Then name a threat and the vulnerability it could exploit, so your risk statement has a clear cause-and-effect chain. After that, judge likelihood and impact separately, even if you only use simple terms like low/medium/high. Prioritise the risks rather than listing them like a shopping list. Finally, propose mitigation and explicitly state whether it reduces likelihood, impact, or both--that one sentence often earns the last mark.

What’s the difference between a threat and a vulnerability in IB Computer Science?

A threat is the thing that could cause harm: an attacker, malware, a power outage, or accidental human error. A vulnerability is the weakness that allows the threat to succeed, such as weak authentication, missing updates, poor physical security, or lack of staff training. In IB Computer Science, marks often come from pairing them correctly rather than defining them separately. If you only name threats (“hackers,” “phishing”) without naming vulnerabilities, your answer stays vague. If you only name vulnerabilities (“weak passwords”) without a threat and impact, the risk feels incomplete. The best exam responses show the relationship: threat exploits vulnerability to damage an asset.

How should I practise risk assessment for IB Computer Science exams?

Practise with short scenarios and time limits, because risk assessment is a writing skill as much as a concept. Use RevisionDojo’s IB Computer Science Questionbank to generate exam-style prompts and train your structure. After each attempt, rewrite your answer in a tighter form: one sentence for asset, one for threat/vulnerability, one for likelihood/impact, one for mitigation. Use Flashcards to memorise key security terms so you don’t waste time searching for words mid-answer. If you’re unsure whether your mitigation matches the vulnerability, ask AI Chat to challenge your logic and suggest a more precise control. Over a week or two, you’ll notice your answers become calmer, more specific, and more “examiner-friendly.”

IB Computer Science Risk Assessment, Explained Simply

IB Computer Science

RevisionDojo Team

•12/27/2025•6 min read

This site uses cookie tracking technologies. Learn more in our Cookie Policy.

IB Computer Science Risk Assessment, Explained Simply

IB Computer Science

RevisionDojo Team

•12/27/2025•6 min read

In IB Computer Science, risk assessment is one of those topics that sounds like paperwork until you realize it’s the story behind almost every real security failure. A school installs new software, a bank migrates data, a hospital digitizes records. Nothing breaks because someone forgot a definition. It breaks because someone made a decision without thinking through what could go wrong.

That’s why IB Computer Science examiners reward the process (how you identify, judge, and reduce risk), not just the phrase “risk assessment.” If you can explain the reasoning calmly and step-by-step, you turn a short scenario into a high-mark answer.

Student builds too many locks instead of a checklist

Risk assessment in IB Computer Science (the fast checklist)

Use this mini-framework whenever a question mentions security, planning, or “reduce harm”:

Identify assets, threats, and vulnerabilities
Judge likelihood and impact
Prioritise risks (not all are equal)
Choose a response: mitigate, accept, avoid, or transfer
Link every control back to the specific risk you found

To practise this with exam-style prompts, build targeted sets in the IB Computer Science Resources hub and then convert your understanding into marks using the Questionbank.

What “risk assessment” actually means

A risk assessment is a structured way to:

spot potential problems before they happen,
estimate how bad they would be,
and decide what to do about them.

In IB Computer Science, a risk exists when a threat can exploit a vulnerability and cause harm to an asset. That relationship matters, because it forces you to explain why the system is at risk, not just what the risk is.

If you want a nearby topic that often appears in the same exam scenarios, see Social Engineering Attacks Explained and notice how “people” can be the vulnerability.

Step one: Identify assets, threats, vulnerabilities

In scenario questions, start by naming the asset. Then the threat. Then the weakness.

Assets: personal data, grades, financial records, system uptime/availability
Threats: hackers, insider misuse, malware, phishing, hardware failure
Vulnerabilities: weak passwords, unpatched systems, poor training, misconfigured permissions

A strong IB Computer Science answer sounds like: “The asset is X, the threat is Y, and the vulnerability is Z, so the risk is…”

For broader exam structure (not just security), it helps to read Mastering IB Computer Science Assessments so you see how examiners reward clear chains of reasoning.

Step two: Analyse likelihood and impact

This is where many IB Computer Science students lose marks: they list risks but never rank them.

Likelihood means: how probable is it?
Impact means: how severe are the consequences?

High-likelihood, high-impact risks get tackled first. A low-likelihood but catastrophic risk might still deserve attention, while a high-likelihood but tiny-impact risk might be monitored rather than fully “solved.”

To strengthen your wording, practise short “evaluate the risk” paragraphs and get feedback using RevisionDojo’s AI Chat and Grading tools inside the IB Computer Science Resources hub.

Step three: Decide what to do (mitigate, accept, avoid, transfer)

After ranking, organisations choose a response:

Mitigate: reduce likelihood and/or impact (patching, access control, training, backups)
Accept: live with the risk if it’s low or mitigation costs too much
Avoid: change the system so the risky feature/process isn’t used
Transfer: move responsibility elsewhere (insurance, outsourcing)

In exam answers, always link the control to the earlier vulnerability. For example: if the vulnerability is “staff click suspicious links,” mitigation is training and filtering, not “add encryption” (which may not address the cause).

You can connect mitigation ideas to core network security concepts in RevisionDojo’s syllabus-aligned notes, such as A2.4.1 Effectiveness of Firewalls at Protecting a Network (Notes).

Common IB Computer Science mistakes (and the fix)

Mistake: Treating all risks as equal.
Fix: Rank them with likelihood and impact.
Mistake: Naming a control without connecting it to a vulnerability.
Fix: Say what weakness it reduces.
Mistake: Forgetting that people are part of the system.
Fix: Include training, procedures, and access levels.

Conclusion: why risk assessment matters for IB Computer Science

Risk assessment in IB Computer Science is really a disciplined habit: notice what matters, imagine what could break it, and choose the most sensible response. Do that clearly, and you’re not just learning security vocabulary--you’re writing the kind of explanation that earns marks.

If you want to turn this topic into consistent exam performance, use RevisionDojo as your home base: refresh the concept in Study Notes, drill it in the Questionbank, lock in language with Flashcards, and sharpen explanations with AI Chat, Grading tools, Predicted Papers, Mock Exams, and Tutors through the IB Computer Science Resources hub.