As we work to manage risks, we will implement controls designed to mitigate those risks. There are a few key terms that we can use to describe different states. - The **inherent risk** facing an organisation is the *original level of risk* that exists before implementing any controls. Inherent risk takes its name from the fact that it is the level of risk inherent in the organisation's business. - The **residual risk** is the risk that remains *after an organisation implements controls* designed to mitigate, avoid, and/or transfer the inherent risk. - An organisation's **risk appetite** is the *level of risk that it is willing to accept* as a cost of doing business. This is a broad term describing overall risk. - An organisation's **risk threshold** is related to its risk appetite, but it is a more specific term. The risk threshold is the *specific level at which a risk becomes unacceptable*. It is the actual boundary that, when crossed, will trigger some action or decision. The risk threshold is usually more quantitative, defining clear points or values. - An organisation's **risk tolerance** is its *ability to withstand risks* and continue operations without any significant impact. - **Key Risk Indicators** (KRIs) are metrics used to *measure and provide early warning signals* for increasing levels of risk. These indicators help in tracking the effectiveness of risk mitigation efforts and make sure that the residual risk stays within the risk appetite. - The **risk owner** is an *individual or entity responsible for managing and monitoring risks*, including implementing necessary controls and actions to mitigate them. These concepts are connected by the way that an organisation manages risk. An organisation begins with its inherent risk and then implements risk management strategies to reduce that level of risk. It continues doing so until the *residual risk is at or below the organisation's risk appetite*. >[!Caution] Risk Appetite >Different organisations have different risk appetites because they operate with different objectives. Generally speaking, the *more risk an organisation is willing to take, the more likely it is that it will fail to meet its goals*, but the *greater the reward it might reap if it does achieve its goals*. Organisations that are not willing to take on higher levels of risk will generally reap fewer rewards, but they have a higher likelihood of success. There are three types of risk appetite that may be suitable for different types of organisations: > >- **Expansionary risk appetites**: Organisations with an expansionary risk appetite are willing to take on higher levels of risk in the pursuit of potential higher rewards. This might be suitable for organisations that are looking to aggressively grow, innovate, or capture market share. They often engage in new ventures, investments, or technologies. > >- **Neutral risk appetites**: Organisations with a neutral risk appetite take a balanced approach. They are willing to take on moderate levels of risk to achieve steady growth and returns. These organisations aim for stability and moderate growth, usually opting for more secure investments and projects. > >- **Conservative risk appetites**: Organisations with a conservative risk appetite tend to avoid high risks and focus on maintaining stability and protecting existing assets. They are generally risk-averse and prioritise security and preservation over high growth. This is common in highly regulated industries or where the consequences of risks are severe. ### Risk Register As risk managers work to track and manage risks, they must *communicate their results to other risk professionals and business leaders*. The **risk register** is the primary tool that risk management professionals **use to track risks facing the organisation**. ![[Risk Register.png]] Above is an excerpt from a risk register used to track IT risks in higher education. The risk register is a *lengthy document that often provides far too much detail* for business leaders. When *communicating risk management concepts to senior leaders*, risk professionals often **use a risk matrix, or heat map**, such as the one shown below. ![[Risk Matrix.png]] This approach quickly summarises risks and allows senior leaders to quickly focus on the most significant risks facing the organisation. Think carefully about the types of information that you want to include in your risk register. Some of the common data elements are: - Risk owner - Risk threshold information - Key Risk Indicators (KRIs) ### Risk Reporting Risk reporting is an essential component of the risk management process that involves *communicating the status and evolution of risks to stakeholders within the organisation*. Effective risk reporting ensures that decision-makers are aware of the current risk landscape and can make informed choices regarding risk mitigation strategies, allocation of resources, and setting priorities. There are **various forms of risk reporting** that an organisation can use, including: - **Regular Updates**: Routine reports that provide stakeholders with the status of risks, the effectiveness of controls, and any recent changes or developments. - **Dashboard Reporting**: Utilises visual aids like graphs and charts to summarise risk data, usually in real time. This allows for a quick understanding and monitoring of key risk indicators. - **Ad Hoc Reports**: These reports are produced as needed, typically in response to specific events or situations that require immediate attention or in-depth analysis. - **Risk Trend Analysis**: This reporting form involves analysing historical data to identify patterns or trends in the risks faced by the organisation. This helps in predicting possible future risks or understanding the evolution of current risks. - **Risk Event Reports**: Focused on documenting specific risk events, such as security breaches or incidents, their impacts, and the responses taken. When compiling a risk report, be sure to *tailor the information and format to the audience*. For example, top-level management might prefer summarised dashboards or high-level reports, whereas a risk management team might need detailed data for analysis. Reports should be clear, concise, and focused, providing essential information that supports decision-making. They should not only highlight the current status but also provide context, such as changes since the last report and how the information relates to the organisation's risk appetite and thresholds