Risk management policy and procedure

Risk management policy and procedure

RI-01 — Policy and risk language

[Organisation] manages uncertainty that can affect its objectives throughout the system life cycle. Risk assessment informs decisions about investment, requirements, design, delivery, operation and retirement. The organisation considers consequences for its own objectives and for affected people and other stakeholders. Risk management is integrated into the work and decisions that create or change exposure; it is not confined to periodic completion of a risk register.

For this procedure, an objective states the outcome sought. A risk source can give rise to uncertainty; an event is an occurrence or change in circumstances; a consequence is an effect on objectives; likelihood describes the chance of occurrence in a defined context. Risk treatment changes the exposure or the way it is managed. Residual risk is the risk remaining after the treatments actually in place. This working vocabulary is informed by ISO 31000:2018 without reproducing its text.

RI-02 — Context and criteria

The risk owner identifies the decision being supported, objectives, scope, time horizon, stakeholders and relevant external and internal conditions. The owner records the applicable risk criteria, including consequence dimensions, likelihood scale or estimation method, uncertainty treatment and the authority required for a decision. Criteria are approved by [authority] and maintained at [location]. They include the organisation’s appetite and tolerances where those have been established.

Assessment considers confidentiality, integrity and availability alongside privacy, safety, mission, financial, contractual and other relevant consequences. A category is used where it helps the decision; it is not discarded merely because it does not fit a cybersecurity score. Ordinal ratings are identified as ordinal. Multiplying labels does not establish a quantitative loss estimate. When quantitative estimates are used, their assumptions, units and uncertainty are retained.

RI-03 — Identification

The assessor reviews stakeholder needs, system descriptions, data flows, threat information, supplier dependencies, changes, incidents and previous findings. Each risk statement identifies an objective, a source or condition, the event or sequence that could occur, and its consequences. The assessor distinguishes an observed issue from an uncertain future event and connects them where the issue changes the risk.

The assessor records the affected assets, people and life-cycle stages, current controls and dependencies. Sources include both hostile actions and mistakes, failures, environmental disruption and unintended processing outcomes. Unknowns are recorded explicitly. Opportunities arising from uncertainty can also be recorded, with their proposed actions and decision authority, without forcing them into a threat-only description.

RI-04 — Analysis and evaluation

The assessor describes the scenario in the actual operating context and assesses likelihood and consequences using the approved criteria. Existing controls are credited according to evidence of their implementation and operation. Planned controls are recorded separately. Analysis identifies assumptions, interactions between risks, common dependencies and any reason an apparently independent control could fail with another control.

The risk owner compares the assessment with the applicable criteria and records whether action or a decision is required. The evaluation identifies who bears the consequence and who has authority over the proposed response. A risk that is acceptable to the delivery team may still require a decision by another accountable party. Where evidence is insufficient, the owner records that limitation and the next action instead of presenting unsupported precision.

RI-05 — Treatment and acceptance

The owner considers changing the activity, avoiding the exposure, changing likelihood or consequences, sharing responsibility through an agreement, or retaining the risk through an authorised decision. The treatment record identifies requirements or controls to implement, cost and resource implications, dependencies, responsible people, target dates and evidence needed to determine whether the treatment worked.

The decision authority records the selected response and its rationale. Acceptance identifies the exact risk, assessed context, known uncertainty, conditions and review date or trigger. It does not waive obligations outside that authority. Insurance or contractual allocation is recorded with its scope and limitations; it does not erase operational consequences or effects on people. A proposed treatment does not reduce the recorded current exposure until its operation has been assessed.

RI-06 — Monitoring and communication

The owner reviews risks at [schedule] and when relevant requirements, architecture, data use, suppliers, threats, incidents or operating conditions change. Trigger records identify who watches for the change. Treatment progress and effectiveness are reviewed separately. The owner updates the current assessment, retains previous decisions and identifies any need to revisit a release or operating authorisation.

Risk reports state the decision needed, consequences, uncertainty and options in language appropriate to the recipient. Stakeholders are consulted where they bear consequences or hold relevant knowledge. Escalation follows the authority register and records when a response is needed. Unanswered escalations remain visible. A closed risk record states why it is closed and where any continuing obligation has been transferred.

RI-07 — Assurance of risk management

The reviewer samples decisions and traces them to context, criteria, evidence and delegated authority. The review tests whether treatment completion claims are supported and whether accepted risks were revisited when conditions changed. It checks that significant stakeholder consequences and uncertain assumptions remain visible. Findings address the quality and use of the process, rather than rewarding a small risk register or a low aggregate score.