Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Who decides…

Who can accept a risk, and does the answer change with its rating?

4 decision pointsThe pack behind this answer: Information Security Risk Management

Add to board memo

The short answer

Recommendation
Yes. The residual band sets who signs, and the position against appetite adds signatures on top: executive management as well outside appetite, and only the board or its equivalent outside tolerance or for any Critical risk. A risk that exists because a rule is broken goes through the exception route instead.
Reasoning
Acceptance means keeping a residual risk knowingly, recorded and approved at the right level until a review date. The rating decides who may accept it, so nobody negotiates the band. Using the residual score, after controls shown to work, ties the approver to the risk actually carried. The position adds approvers and never replaces them, so a risk outside appetite carries the band's signatures and executive management's. Accepting a risk does not bring it within appetite.
Considerations
  • The approvers and review intervals are the defaults in the CISO Times risk pack: risk owner for Low; risk owner and Head of Information Security for Medium; accountable executive and Head of Information Security for High. Your own methodology may name different roles.
  • Outside tolerance or Critical, the band's approvers recommend and the board, or a board risk committee it has delegated to, decides; the management board in a two-tier structure; executive management where there is no board.
  • Within appetite no new decision is needed, so an acceptance form there is optional.
  • Where the risk owner is also the Head of Information Security, name someone else as second approver so nobody accepts their own risk alone.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartA risk owner proposes to accept a residual riskDecisionDoes the risk exist because a policy or standard rule is not met?OutcomeUse the exception route, with its own approversDecisionWhat is the risk's residual band?OutcomeLow: the risk owner acceptsDecisionIs this Medium risk outside its category's appetite?OutcomeMedium: the risk owner and head of information securityDecisionWhere does this High risk sit against appetite?OutcomeHigh: the accountable executive and head of information securityOutcomeOutside appetite: the band's approvers, and executive management tooOutcomeOutside tolerance or Critical: only the board or its equivalent

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 11 steps.

  1. Start

    A risk owner proposes to accept a residual risk

    Acceptance means keeping a residual risk knowingly, recorded and approved at the right level, until a review date. The rating decides who may accept it. Nobody negotiates the band: a manager may disagree with a rating and give a reason, but may not choose the band.

    In the pack

  2. Decision

    Does the risk exist because a policy or standard rule is not met?

    A broken rule is a security exception, not a risk acceptance, and exceptions have their own approvers and time limits. The head of information security checks this before the acceptance goes for signature. If you are not sure, treat it as a broken rule until the rule's owner says otherwise.

    In the pack

  3. Outcome

    Use the exception route, with its own approvers

    The exception's band sets its approver and maximum duration. Where the gap leaves a risk outside appetite, or Critical, the approver the risk method requires for that position also signs the exception. The stricter of the two always applies.

    In the pack

    See also

  4. Decision

    What is the risk's residual band?

    Use the residual score, after controls shown to work, never the inherent one. The pack's bands: Low 1–3, Medium 4–6, High 8–9, Critical 12–16. Between two levels on either scale, round up. The head of information security checks High and Critical ratings before they are recorded.

    In the pack

  5. Outcome

    Low: the risk owner accepts

    A Low residual risk is within appetite in every category, so it needs no new decision and no one else signs. It is recorded in the register, and the owner reviews it every quarter. If the owner records an acceptance on the form anyway, the pack's default is to review it within 12 months.

    In the pack

  6. Decision

    Is this Medium risk outside its category's appetite?

    A Medium risk is within appetite for a Cautious or Open category. For an Averse category it is outside appetite but within tolerance. It is never outside tolerance. If the category is unclear, use the one with the lower appetite.

    In the pack

  7. Outcome

    Medium: the risk owner and head of information security

    Within appetite no new decision is needed and the acceptance form is optional; where the owner uses it, both sign. Where the risk owner is also the head of information security, as often happens when one person runs IT and security, name someone else as second approver so nobody accepts their own risk alone. In the pack's defaults the acceptance is reviewed within 12 months.

    In the pack

  8. Decision

    Where does this High risk sit against appetite?

    A High risk is within appetite only for an Open category. For a Cautious category it is outside appetite, within tolerance. For an Averse category it is outside tolerance. If the position is not known, take the stricter one.

    In the pack

  9. Outcome

    High: the accountable executive and head of information security

    Within appetite no new decision is needed and the acceptance form is optional; where the owner uses it, both sign. If the risk owner is not the accountable executive, the executive signs too. In the pack's defaults a High acceptance is reviewed within 6 months, and the risk is named to executive management in the quarterly report.

    In the pack

  10. Outcome

    Outside appetite: the band's approvers, and executive management too

    Executive management signs in addition to the band's approvers, never instead of them. Its sign-off is a recorded decision, with a minute or reference on the form. Accepting the risk does not bring it within appetite: it stays in the count of risks outside appetite until its score falls or the board changes the appetite.

    In the pack

  11. Outcome

    Outside tolerance or Critical: only the board or its equivalent

    The band's approvers recommend; the top of the organisation decides. Who that is depends on how you are governed: the board, or a board risk committee it has delegated to; in a two-tier structure, the management board; with no board, as in an owner-managed company, executive management. The chair hears out of cycle; the pack's default is within 5 working days. A Critical acceptance is reviewed within 3 months.

    In the pack

    See also

Practical checklist

  1. Check whether the risk exists because a policy or standard rule is not met. If so, use the exception route.
  2. Take the residual band, rounding up between two levels.
  3. Read the position against the category's appetite and tolerance, taking the stricter one if unclear.
  4. Collect the band's signatures, and add executive management's where the risk is outside appetite.
  5. Send a risk outside tolerance or Critical to the board or its equivalent, telling the chair out of cycle.
  6. Set the review date the band requires.

Evidence to have ready

  • The acceptance form with the residual band, position, reason, conditions, signatures and review date.
  • The minute or reference for executive management's or the board's decision where needed.
  • The Head of Information Security's check of any High or Critical rating.
  • For a broken rule, the exception record and its approver instead of an acceptance.

Assumptions

  • The risk is scored after existing controls, and its category has an appetite and tolerance approved by the board or its equivalent.
  • The approvers and review intervals shown are the defaults in the CISO Times risk pack. Your own methodology may name different roles; the principle that the rating sets the approver still holds.

Not covered here