Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

When do we…

When is a risk outside appetite, and what has to happen then?

4 decision pointsThe pack behind this answer: Information Security Risk Management

Add to board memo

The short answer

Recommendation
A risk is outside appetite when its residual band is above the band its category's appetite allows, and outside tolerance when it is also above the tolerance band. Outside appetite, the owner decides treatment within the window. Outside tolerance, the board chair is told out of cycle and the board or its equivalent decides.
Reasoning
Once appetite is set as a band, the position follows from two facts: the residual band after controls that work, and the category's appetite level. Tolerance is the highest band carried for a time while a plan brings the risk back; above it, the board must act, not just be told. A Critical risk is above every tolerance. Outside appetite within tolerance, the owner chooses to reduce, avoid, transfer or accept. Accepting a risk does not bring it back within appetite: it stays counted until its residual score falls or the board changes the appetite.
Considerations
  • The appetite levels, the 30-day window, the 5 working days and the review intervals are the defaults in the CISO Times risk management pack. Your own appetite statement may set different ones.
  • Accepting a risk outside appetite needs executive management's signature as well as the band's usual approvers, never instead.
  • Past tolerance, only the board or its equivalent may decide: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board.
  • Changing the appetite is legitimate only as an open, recorded board decision, followed by a retest of every risk in that category.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartA risk has been scored or rescoredStepTake the residual band, after controls that workStepLook up its category's appetite and toleranceDecisionIs the residual band above the tolerance band?DecisionIs the residual band above the appetite band?OutcomeWithin appetite: the owner reviews it each quarterStepRecord the date and start the 30-day decision windowDecisionWhat does the owner decide within the window?OutcomePlan the actions, each with an owner, date, cost and targetOutcomeAccept with executive management signing as wellOutcomeNo decision in time: escalate to executive managementStepTell the board chair out of cycleDecisionWhat does the board decide?OutcomeRecord the board's acceptance, reason and review dateOutcomeChange the appetite openly, as a recorded board decision

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 15 steps.

  1. Start

    A risk has been scored or rescored

    Whether a risk is acceptable is not a matter of opinion once appetite is set as a band. The position follows from two facts: the risk's residual band and its category's appetite level. It is always stated in words: within appetite; outside appetite, within tolerance; or outside tolerance.

    In the pack

  2. Step

    Take the residual band, after controls that work

    Test the score after existing controls that are in place and shown to work. The inherent score shows what the controls are worth; the residual score is the risk actually carried, and the only one appetite is compared with. Bands are Low 1–3, Medium 4–6, High 8–9 and Critical 12–16.

    In the pack

  3. Step

    Look up its category's appetite and tolerance

    Each category has one level. Averse: appetite Low, tolerance Medium. Cautious: appetite Medium, tolerance High. Open: appetite and tolerance both High, so an Open risk that leaves appetite is already past tolerance. If two categories could apply, use the one with the lower appetite.

    In the pack

  4. Decision

    Is the residual band above the tolerance band?

    Tolerance is the highest band tolerated for a time while a plan brings the risk back. Above it, the risk has passed the point where the board said it must act, not just be told. Critical is above every tolerance. If the band or category is uncertain, take the higher band and the lower appetite.

    In the pack

  5. Decision

    Is the residual band above the appetite band?

    Appetite is the highest band accepted without escalation. For example, a High risk in a Cautious category is outside appetite, within tolerance; a Medium risk in the same category is within appetite.

    In the pack

  6. Outcome

    Within appetite: the owner reviews it each quarter

    No new decision is needed. The owner may still reduce it where that is cheap, and reviews it every quarter. It appears in the quarterly report to executive management like every other risk.

    In the pack

  7. Step

    Record the date and start the 30-day decision window

    Record in the register the date the risk was first assessed outside appetite. The owner's treatment decision is due within 30 calendar days of it, in the pack's defaults, and later reviews do not restart the window. The risk is reported to executive management each quarter and in the next board report, which opens with the position.

    In the pack

  8. Decision

    What does the owner decide within the window?

    The owner chooses one of four: reduce the likelihood or impact, avoid by stopping the activity, transfer part of the impact by insurance or contract, or accept the risk knowingly. The owner may delegate the work, not the decision.

    In the pack

    See also

  9. Outcome

    Plan the actions, each with an owner, date, cost and target

    Each action has an owner, a due date, a cost and the residual score expected when it is done. The risk stays outside appetite until the actions are complete and shown to work. Only then does the expected score become the residual score.

    In the pack

    See also

  10. Outcome

    Accept with executive management signing as well

    The band's usual approvers sign, and executive management signs as well, never instead. Record it on your acceptance form with the reason, conditions and a review date. The risk still counts as outside appetite until its residual score falls or the board changes the appetite.

    In the pack

    See also

  11. Outcome

    No decision in time: escalate to executive management

    The Head of Information Security escalates, naming the risk, its band and position, the date missed and the decision needed. A risk kept outside appetite for more than a quarter without a decision is reported by name to executive management. It is the gap auditors and regulators look for first.

    In the pack

    See also

  12. Step

    Tell the board chair out of cycle

    Within 5 working days in the pack's defaults, the chair hears of it without waiting for the next meeting; a Critical risk also goes to executive management at once. The note says what happened, what it may cost, what is being done and by when, and what is not yet known. The board takes the decision at its next meeting. Where there is no board, as in an owner-managed company, tell executive management.

    In the pack

    See also

  13. Decision

    What does the board decide?

    Only the board or its equivalent may decide a risk past tolerance: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. The band's usual approvers recommend. The board has three options.

    In the pack

  14. Outcome

    Record the board's acceptance, reason and review date

    Record the acceptance on your acceptance form with the board's reason, its conditions and the minute. In the pack's defaults a Critical acceptance is reviewed within 3 months and a High one within 6. The risk stays counted as past tolerance in the board measure until its residual score falls.

    In the pack

    See also

  15. Outcome

    Change the appetite openly, as a recorded board decision

    Raising a category's appetite to bring a risk back within it is a legitimate choice. It must be made openly as a board decision, with its reason, and never as a quiet edit to the register or the statement. Then retest every risk in that category against the new level.

    In the pack

Practical checklist

  1. Take the residual band after controls that are in place and shown to work.
  2. Look up the category's appetite and tolerance, using the lower appetite where two categories could apply.
  3. Record the date the risk was first assessed outside appetite.
  4. Have the owner decide to reduce, avoid, transfer or accept within the window, and escalate if no decision comes.
  5. Plan each treatment action with an owner, due date, cost and expected residual score.
  6. Tell the board chair out of cycle for a risk past tolerance, and put the three options to the board.

Evidence to have ready

  • The register entry with the residual band, category, position and the date first assessed outside appetite.
  • The owner's treatment decision and date, and the treatment plan.
  • The signed acceptance form with reason, conditions and review date, or the board minute recording its decision.
  • The out-of-cycle note to the chair and any escalation for a missed decision.

Assumptions

  • Your appetite is set per risk category as a band on the same scale the register uses, and has been approved.
  • The appetite levels, bands and timings shown are the defaults in the CISO Times risk management pack. Your own appetite statement may set different ones.

Not covered here