When do we…
When does a risk need reassessing outside the annual cycle?
Add to board memoOpen the memo
The short answer
- Recommendation
- Reassess a risk outside the annual cycle whenever a trigger touches it, within 10 working days in the pack's defaults, and before go-live for a major change where you can. If its position against appetite changes, the notices and decisions for the new position follow at once.
- Reasoning
- The quarterly owner review and the yearly reassessment keep the register broadly current, but some events change a risk too much to wait. There are six triggers: a major incident or a revealing near miss; a major change; a new or changed threat; an audit, test or assessment finding; a change in law, regulation or a key contract; and a control that has failed or does not work as assumed. One trigger often touches several risks. A change assessed before go-live can still be adjusted; once live, the assessment can only describe the risk you carry.
- Considerations
- The 2 and 10 working days, the 30-day treatment window and the 5 working days to the chair are the defaults in the CISO Times risk management pack. Your own procedure may set different ones.
- If you are unsure whether an event is a trigger, treat it as one.
- A risk now outside tolerance, or any Critical residual risk, can be accepted only by the board or its equivalent: the board or its delegated risk committee, the management board in a two-tier structure, or executive management where there is no board.
- A risk newly outside appetite keeps its treatment window from the date it was first assessed outside appetite. Later reviews do not restart it.
The decision, step by step
Select any step for the reasoning behind it and where the pack covers it.
- Start
- Step
- Decision
- Outcome
Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.
Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.
Read as text
The same flow written out: each step, its reasoning and where the pack covers it. 11 steps.
Start
Something has happened since the risk was last assessed
A yearly reassessment and a quarterly owner review keep the register broadly current. Between them, some events change a risk too much to wait. Those events are triggers, and a trigger sets its own deadline.
In the pack
- P05-A02 Risk Assessment Methodology & Scoring ModelReview, reassessment and reporting (rules RM-09, RM-10)
Decision
Is the event one of the triggers?
The triggers: a major incident, or a near miss that shows a risk was underrated; a major change to systems, processes, suppliers or the organisation; a new or changed threat relevant to your services; an audit, test or assessment finding; a change in law, regulation or a key contract; a control that has failed, or is found not to work as the assessment assumed. If you are unsure whether it qualifies, treat it as a trigger.
- Yes, or not sure: Record the trigger and list the risks it touches
- No: Leave it for the owner's quarterly review
In the pack
- P05-A03 Risk Identification & Assessment Operating ProcedureStage 8 — Triggered reassessment
- P05-A02 Risk Assessment Methodology & Scoring ModelReview, reassessment and reporting (rule RM-10)
Outcome
Leave it for the owner's quarterly review
Smaller changes are picked up at the quarterly owner review, which asks whether the scenario is still right, the controls still work, the actions are on time, and anything has changed the ratings. A risk not reviewed by quarter end is escalated to the owner's line executive and named in the quarterly report.
In the pack
- P05-A03 Risk Identification & Assessment Operating ProcedureStage 7 — Quarterly owner review and annual reassessment
- P05-A03 Risk Identification & Assessment Operating ProcedureEscalation
Step
Record the trigger and list the risks it touches
Within 2 working days of hearing of it, in the pack's defaults, note the trigger, its date, and every register entry it affects. One incident or change often touches several risks. If it suggests a scenario the register lacks, raise it as a new risk.
In the pack
- P05-A03 Risk Identification & Assessment Operating ProcedureStage 8 — Triggered reassessment
- P05-A05 Information Security Risk RegisterRegister
Decision
Is it a major change that has not gone live yet?
A change can be assessed while it can still be adjusted. Once live, the assessment can only describe the risk you now carry.
- Yes: Assess the touched risks before go-live where possible
- No: Reassess each touched risk with its owner, within 10 working days
In the pack
- P05-A03 Risk Identification & Assessment Operating ProcedureStage 8 — Triggered reassessment
Step
Assess the touched risks before go-live where possible
Run the reassessment as part of the change, and keep it with the change record. Regulated entities are expected to assess risk on each major change, so this record is also their evidence.
In the pack
- P05-A06 Risk Assessment WorkbookInstructions
- P05-A03 Risk Identification & Assessment Operating ProcedureStage 8 — Triggered reassessment
Step
Reassess each touched risk with its owner, within 10 working days
Rate impact and likelihood again, inherent and residual, with a reason for each change. An incident may confirm the threat is real, or show a control worked where it was in place. Count only controls with evidence. If the deadline passes, the assessor escalates to the Head of Information Security.
In the pack
- P05-A03 Risk Identification & Assessment Operating ProcedureStage 8 — Triggered reassessment (rule RM-10)
- P05-A03 Risk Identification & Assessment Operating ProcedureWorked example — one risk over one quarter
- P05-A03 Risk Identification & Assessment Operating ProcedureEscalation
Decision
Has the risk's position against appetite changed?
Read the new residual band against the category's appetite and tolerance. The position is one of three: within appetite; outside appetite, within tolerance; outside tolerance. A Critical residual risk is always outside tolerance.
- No, or back within appetite: Update your register with the new ratings and date
- Now outside appetite, within tolerance: Tell the people its band requires, and decide treatment
- Now outside tolerance: Tell the board chair out of cycle
In the pack
- P05-A02 Risk Assessment Methodology & Scoring ModelThe position rule
Outcome
Update your register with the new ratings and date
Record the reassessment date and the new ratings with reasons, even if nothing moved. A risk that returned within appetite is reported to executive management as movement at the next quarterly report.
In the pack
- P05-A05 Information Security Risk RegisterInstructions
- P05-A03 Risk Identification & Assessment Operating ProcedureStage 7 — Quarterly owner review and annual reassessment
Outcome
Tell the people its band requires, and decide treatment
Notify the people the new band requires. A risk newly outside appetite needs a treatment decision by its owner within 30 calendar days of first being assessed outside appetite, in the pack's defaults. Later reviews do not restart that window.
In the pack
- P05-A03 Risk Identification & Assessment Operating ProcedureStage 4 — Compare with appetite
- P05-A03 Risk Identification & Assessment Operating ProcedureStage 6 — Decide treatment (rule RM-06)
Outcome
Tell the board chair out of cycle
A risk now outside tolerance, or any Critical residual risk, goes to the board chair without waiting for the next meeting, within 5 working days in the pack's defaults. Only the board or its equivalent may accept it: the board or its delegated risk committee, the management board in a two-tier structure, or executive management where there is no board.
In the pack
- P05-A03 Risk Identification & Assessment Operating ProcedureStage 8 — Triggered reassessment
- P05-A04 Cyber Risk Appetite Statement TemplateOutside appetite, outside tolerance: what happens
- P03-A02 Board Reporting Narrative ModelReporting bad news
Practical checklist
- Decide whether the event is one of the six triggers. Leave smaller changes to the owner's quarterly review.
- Record the trigger and every register entry it touches within 2 working days, and raise any new scenario it suggests.
- For a major change not yet live, run the reassessment as part of the change.
- Reassess each touched risk with its owner within 10 working days, counting only controls with evidence.
- Read the new position against the category's appetite and tolerance.
- Notify the people the new band requires, and get a treatment decision for a risk newly outside appetite.
- Tell the board chair out of cycle about a risk now outside tolerance or Critical.
Evidence to have ready
- The trigger record: what happened, when, and the risks it touched.
- The reassessment date and new ratings with reasons, recorded even where nothing moved.
- For a major change, the risk assessment kept with the change record.
- Notices sent and treatment decisions made where the position changed.
Assumptions
- Owners already review each risk every quarter and the whole register is reassessed once a year.
- The timings shown are the defaults in the CISO Times risk management pack. Your own procedure may set different ones.
Not covered here
- What happens when the reassessment puts a risk outside appetite. That is “When is a risk outside appetite, and what has to happen then?”.
- How to score the risk again. That is “How do we score risks consistently when two people assess them?”.