Guide: Introducing Risk Management 

Defining the purpose and objectives of risk management

Successful risk management starts with clearly articulating why you are doing it and what you want to achieve.

Example of objectives:

• Identify and manage IT risks before they become incidents
• Strengthening regulatory compliance (e.g. NIS2, ISO 27001, DORA)
• Enable better prioritization of resources and investments
• Create a culture where risk assessment is a natural part of development and operations

Suggestions for activities:

• Formulate objectives together with IT, information security, operations and management
• List business-critical systems and functions where risk management is most urgent

Anchoring the work in the organization

Risk management requires commitment at all levels - from IT specialists to management.

Suggestions for activities:

• Describe the link between risk management and business objectives
• Clarify roles, responsibilities and decision paths in the risk management process
• Identify and engage risk owners per system or area

Identifying risk areas

It is crucial to start by identifying the types of risks that are relevant in your environment.

Suggestions for activities:

• Make a risk inventory: e.g. system outages, insufficient backups, incorrect authorizations, external influences (cyber threats, suppliers)
• Group risks by area: technology, delivery, people, external impact, compliance
• Involve technology, business and information security in the mapping

Select assessment model and establish risk matrix

Prioritization requires a common model for how risks are assessed.

Suggestions for activities:

• Use a simple matrix (e.g. 3×3 or 5×5) with probability and consequence
• Define what low, medium and high impact actually means in your business
• Develop criteria for what triggers the need for action or follow-up

Documenting and visualizing risks

A structured approach requires that risks are documented in a consistent manner.

Suggestions for activities:

• Use a tool (e.g. Easit GO) to record and manage risks
• Document risk description, owner, assessment, action plan and status
• Visualize risk levels in a dashboard or heatmap

Establish risk management processes

Risk management is not a one-off exercise - it needs to be a continuous process

Suggestions for activities:

• Establish a regular forum or working group on IT risks
• Set up reassessment procedures in case of changes or incidents
• Define how risks are approved, monitored and closed

Integrate with other processes

To be effective, risk work needs to be linked to other governance.

Suggestions for activities:

• Link risks to systems, services or processes in CMDB or service catalog
• Integrate risk management with change management, incident management and project management
• Use risk level as input to prioritize improvement work and investments

Educate and create risk awareness

Everyone in the organization needs to understand why and how risk management is done.

Suggestions for activities:

• Conduct basic risk training for key roles
• Create templates, checklists and guides for risk assessment
• Highlight good examples where risk management has prevented incidents

Follow up and improve continuously

Good risk management is constantly evolving and adapting.

Suggestions for activities:

• Conduct annual reviews of risk registers and methodologies
• Follow up on how many risks have been addressed, what actions have been taken and whether thresholds are set correctly
• Let lessons learned from incidents or audits lead to adjustments

Checklists

Checklist - Identification of risks

• Have we reviewed all business-critical systems?
• Have we mapped dependencies on suppliers and infrastructure?
• Have we taken into account human, technical and organizational risks?
• Have we involved both technology and business in the mapping?

Checklist - Risk assessment

• Are likelihood and impact assessed against defined criteria?
• Have we used our risk matrix consistently?
• Is the assessment approved by the responsible person or group?
• Have we documented supporting facts or observations?

Checklist - Risk management and monitoring

• Is there a person responsible for each risk?
• Are action plans clear and timed?
• Has the risk status been updated after action or reassessment?
• Is follow-up planned in the relevant forum or report?