...

Axes of consequence

Once a risk has been registered, it must be evaluated. A risk is first evaluated according to probability, then according to selected types of consequences:

• HSE

• Environment

• Quality/process

• Information security

• Personal data

• Preparedness/emergencies.

NEW evaluation / RE-evaluation

Once a risk has been defined, it can be evaluated in several places in the organization by NEW evaluating several times and selecting different departments in the org.list each time. The same risks are evaluated on different processes, or different departments / locations, or the same risk on different Assets (e.g. software).

Outcome

When the same risk is evaluated against different areas of the business, we call it different outcomes. In other words, one and the same risk is evaluated with several NEW evaluations with different outcomes.

NB! For each new outcome of a risk, a NEW evaluation must therefore be made. The outcome is tagged during evaluation under the heading "Connection". The outcome must then be unique compared to other outcomes. For each outcome, only RE-evaluation shall be carried out later without making any changes to the Connection fields. So - if you are to make an evaluation of an outcome that has already been evaluated, you must RE-evaluate this risk (not a NEW evaluation) as this picture illustrates: