This statement is false because assessing risk impact does not require an analysis of prior events, frequency of occurrence, and external trends. These factors are relevant for assessing risk likelihood or probability, not impact. Risk impact is the potential consequence or damage that a risk event may cause to the organization or its stakeholders. Risk impact can be measured qualitatively (e.g., high, medium, low) or quantitatively (e.g., monetary value, percentage of revenue, number of customers affected). To assess risk impact, the organization needs to consider the nature and scope of the risk, the potential harm or loss, and the sensitivity or tolerance of the organization or its stakeholders to the risk. References:
* How to Manage and Measure Third-Party Risk, OneTrust Blog
* Third-party risk, Deloitte
* Assessing Risks in Third Parties, ERM - Enterprise Risk Management Initiative