Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Who decides…

Who can accept a risk, and does the answer change with its rating?

5 decision pointsThe pack behind this answer: Information Security Risk Management

Add to board memo

The short answer

Recommendation
Yes. The residual band sets who signs, and the position against appetite adds signatures on top: executive management as well outside appetite, and only the board or its equivalent outside tolerance or for any Critical risk. A Severe impact adds approvers whatever the band says. A risk that exists because a rule is broken goes through the exception route instead.
Reasoning
Acceptance means keeping a residual risk knowingly, recorded and approved at the right level until a review date. The rating decides who may accept it, so nobody negotiates the band. Using the residual score, after controls shown to work, ties the approver to the risk actually carried. The position adds approvers and never replaces them, so a risk outside appetite carries the band's signatures and executive management's. Accepting a risk does not bring it within appetite.
Considerations
  • The approvers and review intervals are the defaults in the CISO Times risk pack: risk owner for Low; risk owner and Head of Information Security for Medium; accountable executive and Head of Information Security for High. Your own methodology may name different roles.
  • Outside tolerance or Critical, the band's approvers recommend and the board, or a board risk committee it has delegated to, decides; the management board in a two-tier structure; executive management where there is no board.
  • Within appetite no decision is needed to carry a risk. If the owner chooses to accept it, the form and the band's signatures are required.
  • Where the risk owner is also the Head of Information Security, name someone else as second approver so nobody accepts their own risk alone.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartA risk owner proposes to accept a residual riskDecisionDoes the risk exist because a policy or standard rule is not met?DecisionIs the residual impact Severe? If so, what is its chance a year?OutcomeUse the exception route, with its own approversDecisionWhat is the risk's residual band?OutcomeLow: the risk owner acceptsDecisionIs this Medium risk outside its category's appetite?OutcomeMedium: the risk owner and head of information securityDecisionWhere does this High risk sit against appetite?OutcomeHigh: the accountable executive and head of information securityOutcomeOutside appetite: the band's approvers, and executive management tooOutcomeOutside tolerance or Critical: only the board or its equivalentOutcomeSevere at 5% to 20%: the band's approvers, and executive managementOutcomeSevere at Possible or above: only the board or its equivalent

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one. A code beside a source, such as RR-17, is the number of a rule in that pack document; the document lists its rules.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 14 steps.

  1. Start

    A risk owner proposes to accept a residual risk

    Acceptance means keeping a residual risk knowingly, recorded and approved at the right level, until a review date. The rating decides who may accept it. Nobody negotiates the band: a manager may disagree with a rating and give a reason, but may not choose the band.

    In the pack

  2. Decision

    Does the risk exist because a policy or standard rule is not met?

    A broken rule is a security exception, not a risk acceptance, and exceptions have their own approvers and time limits. The head of information security checks this before the acceptance goes for signature. If you are not sure, treat it as a broken rule until the rule's owner says otherwise.

    In the pack

  3. Decision

    Is the residual impact Severe? If so, what is its chance a year?

    A residual Severe impact (impact 4) is also decided by its chance, whatever its score or band. In the pack's defaults, under 5% a year the band decides. At 5% to 20%, executive management signs as well as the band's approvers. At Possible or above, only the board or its equivalent may accept. If the chance is not recorded, use the higher. This adds to the band and position rules and never replaces them.

    In the pack

  4. Outcome

    Use the exception route, with its own approvers

    The exception's band sets its approver and maximum duration. Where the gap leaves a risk outside appetite, Critical, or with a Severe residual impact, the approver the risk method requires for that position also signs the exception. The stricter of the two always applies.

    In the pack

    See also

  5. Decision

    What is the risk's residual band?

    Use the residual score, after controls shown to work, never the inherent one. The pack's bands: Low 1–3, Medium 4–6, High 8–9, Critical 12–16. Between two levels on either scale, round up. The head of information security checks High and Critical ratings before they are recorded.

    In the pack

  6. Outcome

    Low: the risk owner accepts

    A Low residual risk is within appetite in every category, so it needs no decision and no one else signs. A Severe impact never scores Low, so the Severe rule never applies here. The owner reviews it every quarter. If the owner chooses to accept it, the form is required; the pack's default is to review it within 12 months.

    In the pack

  7. Decision

    Is this Medium risk outside its category's appetite?

    A Medium risk is within appetite for a Cautious or Open category. For an Averse category it is outside appetite but within tolerance. It is never outside tolerance. If the category is unclear, use the one with the lower appetite.

    In the pack

  8. Outcome

    Medium: the risk owner and head of information security

    Within appetite no decision is needed to carry the risk. If the owner chooses to accept it, the form is required and both sign. Where the risk owner is also the head of information security, as often happens when one person runs IT and security, name someone else as second approver so nobody accepts their own risk alone. In the pack's defaults the acceptance is reviewed within 12 months.

    In the pack

  9. Decision

    Where does this High risk sit against appetite?

    A High risk is within appetite only for an Open category. For a Cautious category it is outside appetite, within tolerance. For an Averse category it is outside tolerance. If the position is not known, take the stricter one.

    In the pack

  10. Outcome

    High: the accountable executive and head of information security

    Within appetite no decision is needed to carry the risk. If the owner chooses to accept it, the form is required and both sign. If the risk owner is not the accountable executive, the executive signs too. In the pack's defaults a High acceptance is reviewed within 6 months, and the risk is named to executive management in the quarterly report.

    In the pack

  11. Outcome

    Outside appetite: the band's approvers, and executive management too

    Executive management signs in addition to the band's approvers, never instead of them. Its sign-off is a recorded decision, with a minute or reference on the form. Accepting the risk does not bring it within appetite: it stays in the count of risks outside appetite until its score falls or the board changes the appetite.

    In the pack

  12. Outcome

    Outside tolerance or Critical: only the board or its equivalent

    The band's approvers recommend; the top of the organisation decides. Who that is depends on how you are governed: the board, or a board risk committee it has delegated to; in a two-tier structure, the management board; with no board, as in an owner-managed company, executive management. The chair hears out of cycle; the pack's default is within 5 working days. A Critical acceptance is reviewed within 3 months.

    In the pack

    See also

  13. Outcome

    Severe at 5% to 20%: the band's approvers, and executive management

    Executive management signs as well as the band's approvers, never instead of them, as a recorded decision with a minute or reference. This holds whatever the position: a Severe impact at Unlikely scores Medium, which is within appetite in a Cautious or Open category, and the override still applies. Where the chance is not recorded, treat it as 5% to 20%. In the pack's defaults the acceptance is reviewed within 12 months.

    In the pack

  14. Outcome

    Severe at Possible or above: only the board or its equivalent

    The band's approvers recommend; only the top of the organisation may accept, whatever the band or position: the board, or a board risk committee it has delegated to; in a two-tier structure, the management board; with no board, executive management. Without this rule a Severe impact at Possible would score 8, High, and the High band's approvers and executive management could accept it. Minute the decision as a decision on a Severe risk, not routine business.

    In the pack

Practical checklist

  1. Check whether the risk exists because a policy or standard rule is not met. If so, use the exception route.
  2. Check whether the residual impact is Severe: at 5% a year or more executive management signs as well, and at Possible or above only the board or its equivalent may accept.
  3. Take the residual band, rounding up between two levels.
  4. Read the position against the category's appetite and tolerance, taking the stricter one if unclear.
  5. Collect the band's signatures, and add executive management's where the risk is outside appetite.
  6. Send a risk outside tolerance or Critical to the board or its equivalent, telling the chair out of cycle.
  7. Set the review date the band requires.

Evidence to have ready

  • The acceptance form with the residual band, position, reason, conditions, signatures and review date.
  • The minute or reference for executive management's or the board's decision where needed.
  • The Head of Information Security's check of any High or Critical rating.
  • For a broken rule, the exception record and its approver instead of an acceptance.

Assumptions

  • The risk is scored after existing controls, and its category has an appetite and tolerance approved by the board or its equivalent.
  • The approvers and review intervals shown are the defaults in the CISO Times risk pack. Your own methodology may name different roles; the principle that the rating sets the approver still holds.

Not covered here