Assess risks at organisational level

Not every risk is tied to a processing activity, an asset or a supplier. Losing a key person, a new regulation that changes how you operate, damage to your reputation or a cyber attack that brings the whole business to a halt all concern the organisation as a whole. These risks are assessed at organisational level: straight on the risk area, with no entity in between, and with the same tools as every other assessment.

Before you start

Organisational risk is part of the Enterprise Risk Management add-on. You need admin rights with access to edit master data to set up the risk area.

Choose the assessment level for the risk area

When you create a risk area, you choose an Assessment level alongside the name, the responsible, the scale and the appetite:

• Per entity works as before: risks are assessed on the processes, assets and suppliers you add to the area.
• The organisation as a whole is for areas where the risks apply across the organisation.
• Per entity and the organisation covers both. An information security area, for example, can hold risks on specific systems alongside risks that affect the entire organisation.

Add and assess an organisational risk

1. Open the risk area and go to the Operational tab.
2. Select Organisation. In an area that covers both, Entities sits next to it.
3. Add the risk scenarios you want to assess. There are no entities to choose first: the scenarios are added directly to the risk area.
4. Select the three dots to the right of a scenario and select Assess.

The assessment works exactly as it does for an entity:

1. Set the consequence level, select the consequences that apply and write a justification.
2. Set the probability level, select the security measures already in place and write a justification.
3. Optionally tick Specify financial exposure to record what the risk would cost if it materialised.
4. Click Save. The risk level is calculated from the area's risk matrix.

From there you decide whether to accept, avoid or mitigate the risk. Mitigation plans, the audit trail and each scenario's timeline all work the same way as for entities.

Tell organisational and entity risks apart

Every assessment has a type showing what it concerns: a processing activity, an asset, a legal entity or the organisation. In the Mitigation overview, the Type column shows whether a plan relates to an entity or to the organisation, and the Entity column is left empty for organisational risks. Filter on type to pull out just your organisational risks.

In the overview and the management report

The risk overview shows your progress on organisational risks just as it does for entities, such as how many scenarios have been assessed and how many sit above appetite. In a risk area that covers both, entities and organisational scenarios are shown separately. The management report follows the same split, so management sees risks tied to entities and risks that concern the organisation as a whole side by side.

Important notes

• An area assessed for the organisation as a whole needs no entities, so you can skip adding them.
• Consequence and probability always require a justification, at organisational level too. It is what gives you an audit trail.

Related Articles

• Create a risk area
• Risk assess an entity
• Create and approve a mitigation plan