Axes of consequence
Once a risk has been registered, it must be evaluated. A risk is first evaluated according to probability, then according to selected types of consequences:
HSE
Environment
Quality/process
Information security
Personal data
Preparedness/emergencies.
NEW evaluation / RE evaluation
Once a risk has been defined, it can be evaluated in several places in the organization by NEW evaluating several times and selecting different departments in the org.list each time. The same risks are evaluated on different processes, or different departments / locations, or the same risk on different Assets (e.g. software).
Outcome
When the same risk is evaluated against different areas of the business, we call it different outcomes. In other words, one and the same risk is evaluated with several NEW evaluations with different outcomes.
NB! For each new outcome of a risk, a NEW evaluation must therefore be made. The outcome is tagged during evaluation under the heading "Connection". The outcome must then be unique compared to other outcomes. For each outcome, only RE evaluation shall be carried out later without making any changes to the Connection fields. So - if you are to make an evaluation of an outcome that has already been evaluated, you must RE evaluate this risk (not a NEW evaluation) as this picture illustrates:
A NEW evaluation uses the plus icon and RE evaluation uses the "repeat" icon. When doing RE evaluations, you will build up a history of this outcome for probability and consequence and be able to see graphs of the development of the risk outcome. In addition, you will be able to see all measures that have been implemented over time and what effect these have had.
An outcome can therefore be based on different organizations as shown in the image above, but also different processes, suppliers, context, assets and several other data types in the system.
If you receive an e-mail with a reminder that you must "reassess" or "reevaluate" a risk, this means that you RE evaluate the outcome in question and build up the history for this particular outcome.
Risk reduction / realize opportunities in case of residual risk
If you do NOT accept a residual risk during evaluation, you must (the system requires) reduce the risk / take advantage of the opportunity in one (or both) of these two ways:
Actions are created to reduce risks and realize opportunities.
Refer to security measures/barriers that are in place to prevent the risk.
When working with risk evaluation
When a risk is evaluated for the first time (NEW evaluation), the system generates a separate risk evaluation that will inherit the selected tagged organizational elements and processes from its "mother", the risk itself. This action makes the work easier, but you should still check if the tagging is correct so that the outcome is correct. You can of course change them. Choose the correct probability and value for each relevant consequence axis. You must fill in at least one consequence axis.
You can choose whether you want to evaluate "Opportunities". This will make the positive scale 1-5 visible during evaluation.
You can also choose to set a "Desired situation". It activates a new matrix exactly like the current evaluation, but allows the user to enter a desired/target value. Over time, work must be done to close this gap.
For each consequence axis selection, you have to decide whether you can accept residual risk or not. If one is not checked, you must choose a solution with action at the end of the form - that is, what do you do with the rest of the risk/opportunity. To reduce risk and exploit opportunities, add measures and/or controls.