High Level Risk Definitions

A short description of the organization’s objective is available in settings

Describe the risk briefly so that people will understand what risk you are assessing

Category (grouping) of risks

Describe the potential impacts should the risk occur, ideally in business terms. Decide whether to use “worst case” or “anticipated” impacts and be consistent. Consistency is especially important as the risk register gets larger and more people get involved in the assessments

Who will be held accountable if the risk treatments are inadequate, incidents occur, and the organization is adversely impacted? It is in this person’s interest to assess and treat the risks adequately or face the consequences

A brief summary of how the risk was assessed, along with any relevant details that will help determine its impact and likelihood

The calculation of risk before any treatment actions have taken place. For example, the risk of financial loss is very high if account numbers and invoices are not verified prior to payment

The likelihood of a risk materializing 

The impact the  risk can have on your business, should it materialize

This is the product of the probability and impact values, or, in other words, the untreated or inherent level of risk

Risks need to be regularly reviewed and setting a next assessment date helps you remember when to come back and review

A calculated measure of risk after any form of treatment has taken place. For example, the risk of fire is reduced by 50% if smoke detectors are installed. Risks can be reduced by adding controls or building treatment plans 

A list of controls helps mitigate the risk

A numerical measure of how useful an organizational control is at reducing a risk. For example, the risk of theft can be reduced by having security cameras (controls). If the cameras are working as designed and no thefts have taken place, the control is 100% effective 

The appropriate strategy to continue reducing risk

• Avoidance
• Remediation
• Transference
• Acceptance
• Mitigation

In case your risk actions do not include controls, you can leverage a free text editor in the Treatment plan section to add details on how the risk will be addressed