How do I set next year's priorities with a fixed budget?

Start

Next year's budget is fixed; you must choose what to fund

A fixed budget turns priorities into trade-offs. The basis that holds up is the risk position the board already sees each quarter, so every choice can be explained in the same words. Each funded item should trace back to a risk and its position.

• Then: List each top risk with its position against appetite

Step

List each top risk with its position against appetite

Take the risks from your register with their residual band and category. Each one is within appetite, outside appetite but within tolerance, or outside tolerance. The quarterly risk report already shows this by risk and by category, with the treatment actions attached.

• Then: Has the board set a cyber risk appetite?

Decision

Has the board set a cyber risk appetite?

Without an approved appetite, nobody can say which risks are acceptable, so any ranking rests on your own judgement alone. Each category of risk should have an appetite level approved by the board.

• Yes: Take out what the budget already carries
• No, or not known: Make agreeing an appetite your first ask

Step

Make agreeing an appetite your first ask

Tell the board plainly that it has not yet set a cyber risk appetite, so you cannot say whether exposure is acceptable, and ask it to agree one. An appetite statement is usually a few sentences, each allowing a risk to be judged inside or outside it. Until one is agreed, the ranking below rests on your own judgement; the pack sets no rule for it.

• Then: Take out what the budget already carries

Step

Take out what the budget already carries

Part of next year's money is already spoken for. Actions done in earlier years add running costs every year, and actions already approved and under way need finishing. The treatment plan shows both: running cost per year, and what is approved, under way or done. What is left is what you can choose with.

• Then: Cost each candidate action and its expected effect

Step

Cost each candidate action and its expected effect

For each action, record an owner, a due date, the one-off cost, any running cost per year, and the residual score expected when it is done. Staff time can be costed where it competes with other work. The expected position after shows whether the action brings the risk back within appetite.

• Then: Is any risk outside tolerance?

Decision

Is any risk outside tolerance?

Tolerance is the point at which the board said it must act, not just be told. A Critical residual risk is always outside tolerance. These risks take the first call on the budget, because leaving one unfunded is itself a decision only the board can take.

• Yes, or not known: Put these first; each needs a board decision
• No: Rank the rest: outside appetite first, then slipping risks

Step

Put these first; each needs a board decision

For each risk outside tolerance the board decides: fund or order treatment, accept the risk explicitly and record why, or change the appetite. Only the board or its equivalent may accept it: the board, or a board risk committee it has delegated to; in a two-tier structure, the management board; where there is no board, executive management.

• Then: Rank the rest: outside appetite first, then slipping risks

Step

Rank the rest: outside appetite first, then slipping risks

Next come actions that bring a risk outside appetite back within it. Then actions that stop a risk within appetite from slipping. A risk within appetite needs no new decision, though its owner may still reduce it where that is cheap. The pack sets no order within each group; whether an action's expected position after is within appetite is one fair test.

• Then: Does the budget cover every risk outside appetite?

Decision

Does the budget cover every risk outside appetite?

Add up the ranked actions until the money runs out. Look hard at what falls below the line: each is a risk the organisation will carry for another year unless something changes.

• Yes: Write the plan and have each risk owner approve it
• No: What will you do about each unfunded risk?

Decision

What will you do about each unfunded risk?

Every risk outside appetite needs a treatment decision, and one kept outside appetite for more than a quarter without one is reported by name to executive management. Silence leaves it outside appetite with nobody having decided. There are three routes: do less or later, carry the risk knowingly, or take the gap to the people who can change the priority or the money.

• Phase it or choose a cheaper action: Phase the work or choose a cheaper action
• Carry it knowingly: Accept what remains, at the level the band sets
• Ask for a decision: Write the gap up as a decision for the board

Step

Phase the work or choose a cheaper action

Fund now the part that reduces the risk most and leave the rest for the next budget, as one of the options in the pack's worked board decision does. Record the residual expected after the funded part only. If the position after is still outside appetite, add actions or record an acceptance for what remains.

• Then: Write the plan and have each risk owner approve it

Step

Accept what remains, at the level the band sets

Accepting is a treatment choice with named approvers. The residual band sets who may accept; a risk outside appetite needs executive management as well, never instead. Outside tolerance, only the board or its equivalent may accept. Each acceptance is recorded and reviewed by a date.

• Then: Write the plan and have each risk owner approve it

Step

Write the gap up as a decision for the board

State the decision in one sentence, why now, at least two real options with what each achieves and costs, your recommendation, the risk of not deciding, and who has agreed. The board decides appetite, priority, money above management's authority and acceptance above tolerance. Choosing products or suppliers stays with management.

• Then: Write the plan and have each risk owner approve it

Step

Write the plan and have each risk owner approve it

The treatment plan sets the period, the risks in scope, objectives with measures of success, and review points. Each risk owner approves the plan and the residual risk it leaves. Funding above your authority goes to whoever your organisation names for it.

• Then: At each quarter, has any risk's position changed?

Decision

At each quarter, has any risk's position changed?

Each quarter, risk owners check that the expected residual is still right and the actions are still the right ones. A trigger such as a major incident, a new threat or an audit finding forces reassessment of the risks it touches. A changed position can change the order.

• Yes: re-rank: List each top risk with its position against appetite (back to an earlier step)
• No: Each risk is funded, phased or knowingly carried

Outcome

Each risk is funded, phased or knowingly carried

The quarterly report to executive management shows the position, its direction, treatment progress and the decisions needed. Carry the same position and decisions into the board report so both say the same.