Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 6 Next »

Axes of consequence

Once a risk has been registered, it must be evaluated. A risk is first evaluated according to probability, then according to selected types of consequences:

  • HSE

  • Environment

  • Quality/process

  • Information security

  • Personal data

  • Preparedness/emergencies.

NEW evaluation / RE evaluation

Once a risk has been defined, it can be evaluated in several places in the organization by NEW evaluating several times and selecting different departments in the org.list each time. The same risks are evaluated on different processes, or different departments / locations, or the same risk on different Assets (e.g. software).

Outcome

When the same risk is evaluated against different areas of the business, we call it different outcomes. In other words, one and the same risk is evaluated with several NEW evaluations with different outcomes.

NB! For each new outcome of a risk, a NEW evaluation must therefore be made. The outcome is tagged during evaluation under the heading "Connection". The outcome must then be unique compared to other outcomes. For each outcome, only RE evaluation shall be carried out later without making any changes to the Connection fields. So - if you are to make an evaluation of an outcome that has already been evaluated, you must RE evaluate this risk (not a NEW evaluation) as this picture illustrates:

A NEW evaluation uses the plus icon and RE evaluation uses the "repeat" icon. When doing RE evaluations, you will build up a history of this outcome for probability and consequence and be able to see graphs of the development of the risk outcome. In addition, you will be able to see all measures that have been implemented over time and what effect these have had.

An outcome can therefore be based on different organizations as shown in the image above, but also different processes, suppliers, context, assets and several other data types in the system.

If you receive an e-mail with a reminder that you must "reassess" or "reevaluate" a risk, this means that you RE evaluate the outcome in question and build up the history for this particular outcome.

Risk reduction / realize opportunities in case of residual risk

If you do NOT accept a residual risk during evaluation, you must (the system requires) reduce the risk / take advantage of the opportunity in one (or both) of these two ways:

  • Actions are created to reduce risks and realize opportunities.

  • Refer to security measures/barriers that are in place to prevent the risk.

When working with risk evaluation

  • When a risk is evaluated for the first time (NEW evaluation), the system generates a separate risk evaluation that will inherit the selected tagged organizational elements and processes from its "mother", the risk itself. This action makes the work easier, but you should still check if the tagging is correct so that the outcome is correct. You can of course change them. Choose the correct probability and value for each relevant consequence axis. You must fill in at least one consequence axis.

  • You can choose whether you want to evaluate "Opportunities". This will make the positive scale 1-5 visible during evaluation.

  • You can also choose to set a "Desired situation". It activates a new matrix exactly like the current evaluation, but allows the user to enter a desired/target value. Over time, work must be done to close this gap.

  • For each consequence axis selection, you have to decide whether you can accept residual risk or not. If one is not checked, you must choose a solution with action at the end of the form - that is, what do you do with the rest of the risk/opportunity. To reduce risk and exploit opportunities, add measures and/or controls.

Evaluation of risks

See flowchart in a separate article on how to carry out evaluations in various places in the system.

Section 1 - meta information

Title

  • The system copies the title from the risk itself - can be changed if desired

Description

  • If desired, the evaluation can be described here in more detail: why, change, situation, project, is it a periodical evaluation, etc.

Next evaluation

  • The system automatically sets the next evaluation to one year in the future. Can be changed during evaluation.

Owner

  • The person who owns the risk is automatically entered here - can be changed.

Deputies

  • Here, those who are proxies in the risk itself are copied in - can be edited

Participants

  • Here, the participants from the risk itself are copied in - can be edited

Section 2 - Associated with

  • No labels