Risk Management Framework
Overview
FundApps approaches both information security and business continuity from risk based principles. Each identified information security or business continuity risk is reviewed with regard to Likelihood (the possibility of a risk happening), and Impact (the consequence of a risk happening).
Risks can be identified by any member of staff, and, staff members are encouraged to contribute. Once risks are identified and reviewed for Likelihood and Impact, an appropriate remediation plan can be formulated.
The key is that risk management drives activity to resolve identified risks, and is the responsibility is that of each employee of FundApps.
Risk Appetite
FundApps has no appetite for safety risks that could result in the injury or loss of life of FundApps staff, clients or partners.
FundApps has no appetite for information security risks that could result in unauthorised or accidental disclosure of, client or other sensitive information.
FundApps has a low appetite for business continuity risks which prevent the ability to provide service to clients.
Risk Tolerance
It is important to note that following the risk management framework, any risk that equals or exceeds a risk rating of twelve (12) will exceed the FundApps Risk Tolerance level and therefore will require a risk treatment plan to lower the risk profile. See the FundApps Risk Management Matrix at the bottom of the page for further information.
Risk Management Process
A- Risk Identification
Potential information security risks and business continuity risks are identified through both formal and informal channels:
Monthly security review meetings
Incident response and reviews
As part of the Software Development Lifecycle
As part of the continuous release management
As part of everyday working practice
B- Risk Assessment
Likelihood and impact
Potential risks are recorded in the risk register and assigned an owner. Risks are assessed on two criteria with regards to any current controls that may already be in place:
Likelihood, according to the FundApps Risk Management Matrix (cf. bottom of the page). Likelihood should consider the specific vulnerability or threats that may exploit this vulnerability.
Impact, according to the FundApps Risk Management Matrix (cf. bottom of the page). Further guidance must be taken from the FundApps Data Classification and Handling Policy when referring to impact. This will take into account the Confidentiality, Integrity and Availability requirements of any data asset.
Residual risk
The assessment of likelihood and impact places the risk within risk tolerance levels defined in the Risk Management Matrix (cf. bottom of the page).
Each risk level consists of
the likelihood and impact levels
a timeframe for review while the risk is open
a timeframe for review once the risk is closed
C- Risk Response
Based on this categorization we can then design a risk response in order to reduce our residual risk.
Strategies for responding to the risk can include:
Avoid risk – activities with a high likelihood of loss and large business impact. The best response is to avoid the activity.
Mitigate risk – activities with a high likelihood of occurring, but business impact is small. The best response is to use management control systems to reduce the risk of potential loss.
Transfer risk – activities with low probability of occurring, but with a large business impact. The best response is to transfer a portion or all of the risk to a third party by purchasing insurance, hedging, outsourcing, or entering into partnerships.
Accept risk – if cost-benefit analysis determines the cost to mitigate risk is higher than cost to bear the risk, then the best response is to accept and continually monitor the risk.
Our risk response may generate information security or business continuity controls which could be technical, procedural or policy based.
D- Risk and Control Monitoring
Identified risks and their mitigating controls are monitored and reviewed at least annually in order to ensure the residual risk is within the risk appetite. Should the residual risk change, either due to a change in the intrinsic risk, or due to the control effectiveness, the risk response will be reviewed.
Risk Management Matrix
Use of definitions based upon ISACA’s standard Glossary of Terms
Last updated
Was this helpful?
