How do we decide between treating, transferring, avoiding and accepting a risk?

Start

A risk has been scored and needs a treatment choice

The four options are reduce (treat with controls), avoid, transfer and accept. The choice is made on the residual score, the one that counts only controls in place and shown to work. The business owns the risk, so the executive who would feel the harm decides. The security team assesses and advises.

• Then: Is the residual risk outside the category's appetite?

Decision

Is the residual risk outside the category's appetite?

Compare the residual band with the appetite set for the risk's category. The result is one of three positions: within appetite; outside appetite, within tolerance; or outside tolerance. A Critical risk is outside tolerance in every category. If the category or its appetite is unclear, use the category with the lower appetite.

• No, within appetite: No new decision needed; reduce it only where that is cheap
• Yes, or not known: Is it outside tolerance, or rated Critical?

Outcome

No new decision needed; reduce it only where that is cheap

A risk within appetite is at a level the organisation has already said it will carry. The owner reviews it every quarter with the rest of the register. The owner may still choose to reduce it where the control is cheap. If a later review moves it outside appetite, the decision becomes due then.

Decision

Is it outside tolerance, or rated Critical?

Tolerance is the highest band the category may carry for a time while a plan brings it back. Past that point, the choice is no longer the owner's alone: the board or its equivalent decides. If you cannot tell, take the stricter answer.

• Yes, or not known: Prepare the options for the board or its equivalent to decide
• No: The risk owner decides, within the window

Step

Prepare the options for the board or its equivalent to decide

Tell the board chair out of cycle; the pack's default is within 5 working days. Who decides depends on how you are governed: the board, or a board risk committee it has delegated to; in a two-tier structure, the management board; with no board, executive management. The options below are still the ones to cost and put to them. The board may also change the appetite, openly and on the record.

• Then: Is there a control worth its cost against the harm?

Step

The risk owner decides, within the window

The pack's default window is 30 calendar days from the date the risk was first assessed outside appetite. Later reviews do not restart it. If the owner has not decided in time, the head of information security escalates to executive management. A risk outside appetite with no decision is the gap auditors look for first.

• Then: Is there a control worth its cost against the harm?

Decision

Is there a control worth its cost against the harm?

Reducing changes the likelihood or the impact. Put a cost on the control and set it against what the scenario would cost, stop or breach. The best control addresses the weakness in the scenario itself: in the pack's fraud example, two general controls moved the score one band, and a call-back check on bank details brought it within appetite.

• Yes, or not yet costed: Reduce: plan actions with owner, date, cost and expected score
• No: Can the business stop the activity that creates the risk?

Step

Reduce: plan actions with owner, date, cost and expected score

Each action goes in your treatment plan with one owner, a due date, a cost and the residual score expected when it is done. The expected score becomes the residual only once the action is done and shown to work. A planned control never lowers today's score.

• Then: Will what remains be within appetite?

Decision

Can the business stop the activity that creates the risk?

Avoiding means the scenario can no longer happen: the service is withdrawn, the asset retired or the data no longer held. The business owner answers this, because it gives up whatever the activity delivers. A partial stop can still help. In the pack's laptop example, banning customer data exports was adopted as a condition of the acceptance.

• Yes: Avoid: stop the activity, then close the risk with evidence
• No: Would insurance or a contract actually cover the impact?

Outcome

Avoid: stop the activity, then close the risk with evidence

Close the risk once the activity has actually stopped, with evidence, and with the head of information security agreeing. Keep the closed entry in the register. A risk that has only become less likely is not closed: it stays in the register at its new rating.

Decision

Would insurance or a contract actually cover the impact?

Transfer shares the impact with a third party. It usually lowers the impact on the organisation and leaves the likelihood unchanged. Read what the policy or contract covers. Insurance may meet the costs of a breach and still leave the harm to customers and the duty to notify with you. If you don't know what it covers, answer no.

• Yes: Transfer: rescore the impact the cover leaves with you
• No, or not known: Does the risk exist because a policy or standard rule is not met?

Step

Transfer: rescore the impact the cover leaves with you

The risk owner still owns the risk after a transfer. Rescore the residual with the cover in place, counting only what it pays for. A service provider running the system does not take the risk either: transferring part of the impact by contract does not transfer the ownership.

• Then: Will what remains be within appetite?

Decision

Will what remains be within appetite?

Read the expected position after the action or cover, using the same matrix and appetite. If it is still outside appetite, look again for further actions. Where none is worth it, accept what remains at the right level. A reduction and an acceptance of the remainder can sit together on one risk.

• Yes: Record the treatment and track it to the expected score
• No, or not known: look again: Is there a control worth its cost against the harm? (back to an earlier step)

Outcome

Record the treatment and track it to the expected score

Link the actions to the risk in your register. When an action is done, reassess the risk and check the residual reached what was expected. Overdue actions are reported to executive management every quarter; the pack's target is none more than 30 days overdue.

Decision

Does the risk exist because a policy or standard rule is not met?

Acceptance is for a risk where every rule is met, or no rule covers it. If a required control is missing, late or configured differently from the standard, that is a security exception, and the exception comes first. An acceptance can never be used to get round a refused exception. If you are not sure, check with the owner of the rule.

• Yes, or not known: Request a security exception, not an acceptance
• No: Accept knowingly, at the level the band and position require

Outcome

Request a security exception, not an acceptance

An exception is time-limited by its band and recorded in your exception register. Signed by the risk owner, it is also the decision to carry the risk of the gap, so no acceptance form is needed as well. Where the gap leaves a risk outside appetite or Critical, the approver that position requires signs the exception too.

Outcome

Accept knowingly, at the level the band and position require

Complete your acceptance form: why each other option was not chosen, why keeping the risk is worth it, and conditions someone else can check. The band's approvers sign; outside appetite, executive management signs as well. Outside tolerance, only the board or its equivalent may accept. The acceptance has a review date: in the pack's defaults, 12 months for Low and Medium, 6 for High and 3 for Critical.