Risk hierarchy and scoring

Starting with New York, risk managers can create hierarchies that include different types of risk (operational risk, IT risk, or strategic risk). Once the underlying risks are assessed, the risk scores are automatically rolled up across the risk statement hierarchy, providing better tactical and strategic decision-making.

Risk Hierarchy

Risk managers and administrators create and view hierarchies on the risk statement form:

• Define a parent risk statement using the Parent field
• Add children risk statements using the Risk Statements related list

Note:

Risk users can view the hierarchies established by the managers and administrators.

Depending on the risk areas, different people in the organization own and manage their own risks. However, top-level risk scores take into account the score of all the risks below it. Therefore, managing all the different risk areas in a central location provides an integrated view of your organizations total risk posture.

Figure 1. Hierarchical risk taxonomy showing integrated view of risk

Translate quantitative risk scores to qualitative values

The Tolerance Status and the Calculated Score are based on the Calculated Annual Loss Expectancy (ALE) of the underlying risks:

• Sum of calculated ALE
• Average calculated ALE
• Maximum calculated ALE
• Minimum calculated ALE

Note:

Only risks in the Monitor state can contribute to the risk statement scores.

Figure 2. Risk Rollup and Tolerance tab

• Association of entities at any level of a risk statement
  You can associate entities, entity types, and indicator templates, at any level of the risk statement hierarchy. Creating this association is useful for risk managers while assessing risks.

Related concepts

• Workflow of a risk using Advanced Risk
• Manage risks linked to the same risk statement