Overview
All of us perform numerous risk assessments in our everyday life, usually without realising it. The classic case is whether or not to cross the road. We weigh up the risks of the possible threats of the traffic and other possible influences, the impacts of those risks crystallising and the cost of taking any precautions, if appropriate, and then make a decision to act or not as the case may be. We make these decisions automatically and instinctively.
Whilst on an individual basis this approach is perfectly acceptable as we are in control of our own lives, it is too subjective for the protection of your corporate information and your other organisational assets. You need a consistent approach to managing these risks so that any competent person undertaking a risk assessment will arrive at similar conclusions by following your chosen methodology for managing risks.
There are two main approaches to risk management, quantitative risk assessment and qualitative risk assessment, or one can use a hybrid approach combining the two. The goal of quantitative risk assessments is to try to calculate objective numeric values for each of the components gathered during the risk assessment and determining a cost benefit analysis. Qualitative risk assessment uses relative vales that are pre-defined by the organisation.
Service Offering
FCL Consultants have significant experience of delivering information risk management for a variety of organisations in the UK and around the world.
FCL has experience of and worked with the following national and international risk standards:
- AS / NZS 4360 (Australia / New Zealand);
- BS 31100 (British);
- ISO 27001 (International);
- ISO 27005 (International);
- ISO 31000 (International);
- NIST 800 – 30 (USA).
In addition to these standards, there are numerous risk assessment and management tools available ranging from a simple Excel spreadsheet to a fully integrated risk management system.
FCL can:
- advise on project risk management.
- assist in defining risk treatment options;
- define appropriate risk assessment and treatment processes for your organisation;
- develop and implement your corporate risk register;
- identify alternate or compensating controls, where necessary;
- implement risk management procedures within your organisation;
- implement your chosen risk treatment options;
- perform risk assessments for you, using your chosen methodology;
- train your staff in the relevant risk management processes and procedures
- undertake risk assessments of major projects and programmes;
- undertake risk management services for a variety of management System Standards (e.g. ISO 9001, ISO 20000, ISO 22301, ISO 27001, OHSAS 18001, etc);
- undertake risk services for a variety of legislation and regulation (e.g. Data Protection Act, Sarbanes Oxley, FCA Requirements, etc).
- undertake strategic risk assessments of ICT infrastructures;
Approach
- identify;
- formalise;
- document;
- implement;
- operate;
- train your employees in appropriate risk management programs.
The FCL approach takes into account the complex business, competitive, regulatory and compliance drivers that affect our Client’s businesses and the achievement of their goals.
Different Clients will have and use different approaches and / or tools, and FCL has worked with the many of the major tools. In essence all risk management approaches are similar and undergo the following steps:
- identify the scope or context for the risk assessment;
- identify the assets within the scope or context;
- identify the asset owners;
- value the assets;
- identify the threats to those assets and evaluate them;
- identify the vulnerabilities in those assets and likelihood of the identified threats exploiting them;
- identify the impact of that exploitation;
- identify existing controls in palace and their effectiveness;
- identify the organisation’s risk appetite;
- compare the residual risk with the risk appetite;
- take appropriate action if the residual risk exceeds the risk appetite;
- monitor all risks regularly and take action as appropriate. :
Note: Assets can be tangible as well as intangible such as reputation.
There is no ‘one size fits all’ and FCL are skilled at building risk management processes appropriate for their Client’s needs.
Selection of controls to address risks can come from a variety of sources, the most common being:
- ISO 27001;
- CoBIT;
- ITIL / ISO 20000;
- NIST 800-53
Benefits
FCL can help its Clients by providing:
- advice on implementation of appropriate risk management processes for a variety of Management Standards;
- assurance that you have identified all assets at risk within your scope of risk management;
- evaluate risk treatment options;
- expertise to review past risk assessments;
- independent and unbiased risk management advice;
- train your employees in undertaking risk assessment using a variety of tools and methodologies;
Next Steps
- FCL are justifiably proud of our 100% SUCCESS RATE, of achieving first time certification through an Accredited Certification Body for our Clients;
- FCL is committed to providing a consistently high value service to our Clients;
- David Lilburn Watson, who remains personally ‘hands-on’ throughout the process, manages this process.
- to understand how the FCL suite of offerings can be used to transform your business, please contact us
- we look forward to discussing your specific requirements, at your convenience;
- we offer a free Health Check for ISO 31000;
- whatever other type of consultancy you require, we can possibly offer a free Health Check.