Procedure
Risk Assessment Methodology Procedure
This procedure defines the methodology for conducting risk assessments across all organizational domains including information security, privacy, AI, business continuity, supply chain, and operational risk. It establishes a consistent approach for identifying, analyzing, evaluating, and treating risks, aligned with ISO 31000:2018 and ISO/IEC 27005:2022.
- Type
- Procedure
- Version
- 1.2.13
- Date
- 2026-09-25
- Owner
- GRC Programme Manager
- Approving authority
- Chief Information Officer
- Classification
- Public
- Confidentiality
- Public
- Category
- Risk
- Review frequency
- Annual and upon material risk framework or regulatory change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Scope
- Roles and responsibilities
- 1. Risk assessment process overview
- 2. Establish context
- 3. Risk identification
- 4. Risk analysis
- 5. Risk evaluation
- 6. Risk treatment
- 7. Risk register
- 8. Monitoring and review
- Framework alignment
Frameworks it maps to
- ISO 31000:2018
- IEC 31010:2019
- ISO/IEC 27005:2022
- ISO/IEC 42001:2023
- NIST SP 800-30r1
- NIST IR 8286A Rev. 1
- COBIT 2019
- CSA CCM v4.1
Related documents
- Enterprise Governance and Risk Management Policyrisk
- Governance Performance and Improvement Frameworkgovernance
- Corrective and Preventive Action (CAPA) Procedurecompliance
- AI Risk Registerai
Next
All Documents