PO09 Process Description

PO09: Risk Assessment

1. Description

IT risk identification and impact analysis, involving multi-disciplinary functions and taking cost-effective measures to mitigate risks.

2. Control Objectives

Business Risk Assessment - Risk assessment framework, risk assessment at a number of levels, reassessments and information updates
Risk Assessment Approach - establish a general risk assessment approach which defines the scope and boundaries, the methodology to be adopted for risk assessments, the responsibilities and the required skills
Risk Identification - Cause/effect relationships, qualitative and quantitative risk ranking, risk classification
Risk Measurement - Measurement of risk exposure, assessment of risk acceptance capacity
Risk Action Plan - Cost-effective controls and security measures, risk strategies in terms of avoidance, mitigation or acceptance
Risk Acceptance - Formal acceptance of residual risk, offset by insurance, contractual liabilities
Safeguard Selection - Control system to balance prevention, detection, correction and recovery measures
Risk Assessment Commitment - Important tool in design and implementation as well as monitoring and evaluation mechanisms

3. Key Goal Indicators

Increased degree of awareness of the need for risk assessments
Decreased number of incidents caused by risks identified after the fact
Increased number of identified risks that have been sufficiently mitigated
Increased number of IT processes that have formal documented risk assessments completed
Appropriate percent or number of cost effective risk assessment measures

4. Key Performance Indicators

Number of risk management meetings and workshops
Number of risk management improvement projects
Number of improvements to the risk assessment process
Level of funding allocated to risk management projects
Number and frequency of updates to published risk limits and policies
Number and frequency of risk monitoring reports
Number of personnel trained in risk management methodology

5. Critical Success Factors

There are clearly defined roles and responsibilities for risk management ownership and management accountability
A policy is established to define risk limits and risk tolerance
The risk assessment is performed by matching vulnerabilities, threats and the value of data
Structured risk information is maintained, fed by incident reporting
Responsibilities and procedures for defining, agreeing on and funding risk management improvements exist
Focus of the assessment is primarily on real threats and less on theoretical ones
Brainstorming sessions and root cause analyses leading to risk identification and mitigation are routinely performed
A reality check of the strategy is conducted by a third party to increase objectivity and is repeated at appropriate times

6. Service Maturity Variations

0 Non-existent	There is little awareness of external requirements that affect IT, with no process regarding compliance with regulatory, legal and contractual requirements.
1 (Initial/Ad Hoc)	Risk assessment for processes and business decisions does not occur. The organisation does not consider the business impacts associated with security vulnerabilities and with development project uncertainties. Risk management has not been identified as relevant to acquiring IT solutions and delivering IT services.
2 (Repeatable but Intuitive)	The organization is aware of its legal and contractual responsibilities and liabilities, but considers IT risks in an ad hoc manner, without following defined processes or policies. Informal assessments of project risk take place as determined by each project. Risk assessments are not likely to be identified specifically within a project plan or to be assigned to specific managers involved in the project. IT management does not specify responsibility for risk management in job descriptions or other informal means. Specific IT-related risks such as security, availability and integrity are occasionally considered on a project-byproject basis. IT-related risks affecting day-to-day operations are infrequently discussed at management meetings. Where risks have been considered, mitigation is inconsistent.
3 (Defined Process)	An organization-wide risk management policy defines when and how to conduct risk assessments. Risk assessment follows a defined process that is documented and available to all staff through training. Decisions to follow the process and to receive training are left to the individual’s discretion. The methodology is convincing and sound, and ensures that key risks to the business are likely to be identified. Decisions to follow the process are left to individual IT managers and there is no procedure to ensure that all projects are covered or that the ongoing operation is examined for risk on a regular basis.
4 (Managed and Measurable)	The assessment of risk is a standard procedure and exceptions to following the procedure would be noticed by IT management. It is likely that IT risk management is a defined management function with senior level responsibility. The process is advanced and risk is assessed at the individual project level and also regularly with regard to the overall IT operation. Management is advised on changes in the IT environment which could significantly affect the risk scenarios, such as an increased threat from the network or technical trends that affect the soundness of the IT strategy. Management is able to monitor the risk position and make informed decisions regarding the exposure it is willing to accept. Senior management and IT management have determined the levels of risk that the organisation will tolerate and have standard measures for risk/return ratios. Management budgets for operational risk management projects to reassess risks on a regular basis. A risk management database is established.
5 Optimized	Risk assessment has developed to the stage where a structured, organisation-wide process is enforced, followed regularly and well managed. Risk brainstorming and root cause analysis, involving expert individuals, are applied across the entire organisation. The capturing, analysis and reporting of risk management data are highly automated. Guidance is drawn from leaders in the field and the IT organisation takes part in peer groups to exchange experiences. Risk management is truly integrated into all business and IT operations, is well accepted and extensively involves the users of IT services.