Risk Management Policy
Framework for identifying, assessing and treating risks
Purpose
Provide a standardized approach to identifying, assessing, treating and monitoring risks, ensuring the resilience and compliance of the information security framework across all Business Units.
Risk Configuration
- Likelihood: High (has already happened), Medium (plausible), Low (unlikely).
- Impact: High (legal/contractual), Medium (reputational), Low (minimal).
- Risk Register: Each risk has an owner, interested parties and a defined response protocol.
- Clear operational objectives are used to guide resource allocation and decision-making.
Recording and Reporting
- Document risk management actions and results to inform decisions and improve processes.
- Consider the sensitivity of the information, context, interested parties, cost, frequency and relevance of the report.
Risk Assessment
- Identification: Recognize risks that may affect objectives; consider sources, causes, events, vulnerabilities, assets, opportunities, context and information limitations.
- Analysis: Assess nature, likelihood, consequences, existing controls, complexity, volatility and biases.
- Evaluation: Compare against risk criteria to decide on actions: maintain, treat, analyze further or reconsider objectives.
Special Consideration
Risks from technology and critical devices (e.g. POI) must be assessed with specific analysis and an appropriate inspection frequency and type.
Risk Treatment
- Formulate and carry out measures to mitigate risks.
- Treatment options: mitigate, accept, eliminate, change likelihood/consequence, share or retain risks in an informed way.
- Evaluate effectiveness and document residual risks for monitoring and additional actions if necessary.
Treatment Plan
- Defines owners, actions, resources, performance measures, constraints, monitoring and schedule.
- Justifies the choice of options and the expected benefits.
Monitoring and Review
- Regularly review risk management, results and the effectiveness of treatments.
- Update methodologies, record changes and perform annual reviews to ensure traceability and continuous improvement.