Well-informed risk decisions are dependent upon knowing the risk associated with the decisions, as well as the best risk management options.

Understanding risk also means that the decision-maker understands the factors that cause change, the assets associated with impact, the threats against those assets, and controls that are in place to manage risk. If any of these inputs are absent, the understanding of risk can be seriously deficient and the resulting decisions flawed. This will then make risk decisions more difficult to ascertain and implement.