Risk assessment method
Last checked on
This is where you agree how risks are weighed: the scales for likelihood and impact, where low turns into medium and medium into high, and up to which score a risk may be accepted through the normal process.
Why this protects your organisation
If two colleagues rate the same risk differently, your risk register tells you very little. A fixed method means everyone measures with the same yardstick, this year's risks can be compared with last year's, and it is clear who may accept a large risk. ISO 27001 clause 6.1 asks for a documented approach like this, so that repeating an assessment gives comparable results.
Steps
- Open Risk assessment method in the Risks group. A new workspace already has a draft with a five level scale for both likelihood and impact.
- Adjust the levels under Likelihood scale and Impact scale where needed. Level 1 is the first entry.
- Fill in Low threshold, Medium threshold and Acceptance threshold.
- Under Acceptance role above the threshold, choose which role may accept a risk that scores above the acceptance threshold.
- Click Save, then Establish.
- To change something later, click Start a new version. The established version stays in force until you establish the new one.
How the score works
A risk scores likelihood times impact. With the default five by five scale, scores therefore run from 1 to 25. At or under the Low threshold the risk level is low, at or under the Medium threshold it is medium, and anything above that is high.
Accepting risks
The Acceptance threshold sets the highest score at which someone with ordinary edit rights may accept a risk. Above it, only the role you pick under Acceptance role above the threshold (Owner, Member or Advisor) may accept the risk. That way nobody takes on a large risk on behalf of the organisation without the right mandate.
Versions
The method is versioned. The top of the page shows the established version, with who established it and when. A change starts as a new draft and only takes effect once you establish it. Until a version has been established for the first time, you cannot choose likelihood and impact on a risk.
If you use the default scales, every user sees them in their own language. If you have changed a scale, it appears exactly as you wrote it.
If it does not work
I only see the established method, not a form
An established version can no longer be edited. Click Start a new version to open a draft that starts from the current values.
I do not see Save, Establish or Start a new version
Those are available to the workspace owner and members. An advisor needs edit rights on the Risks and controls module.
Saving fails
Each scale needs at least two levels, each level needs a name, and the Medium threshold must be higher than the Low threshold.
Screens this is about
- Risk assessment method