You're Already Assessing Risk
Transcription
A lot of times our clients don’t think that they are doing risk assessment and they think they have to do something different than they’re already doing, but actually they are doing risk assessments. It’s just informal. One of the things that we enjoy doing is teaching organizations how they are currently doing risk so that you can see how to formalize that and turn it into something that is written and documented for compliance purposes. For example, most organizations look at things that are threatening their environment. They look at changes that are happening. These conversations are happening in the hallway, they’re happening in the boardroom, they’re happening during our regular video conference meetings where we’re discussing problems. This problem came up with this employee the other day. This client brought this concern to us about our application. A competitor just entered the market. Did you hear about the phishing email that someone received? These things are being talked about all the time and are being dealt with. They’re just not being formalized; they’re not being documented. So, you are currently involved in risk assessment. You are performing risk assessments. You just have to identify the informal way that you are having these conversations and start looking for ways to document that. If you do have a regular meeting of your management team, if you have regular departmental meetings, start keeping minutes of those meetings and put a section in there titled “Risk,” so that whenever things come up about upgrading something, or improving an approach that you have to a threat or a problem that’s facing your business, you can start documenting the risks that you’re discussing and turn that into a formal, written risk assessment.
A lot of times our clients don’t think that they are doing risk assessment and they think they have to do something different than they’re already doing, but actually they are doing risk assessments. It’s just informal. One of the things that we enjoy doing is teaching organizations how they are currently doing risk so that you can see how to formalize that and turn it into something that is written and documented for compliance purposes. For example, most organizations look at things that are threatening their environment. They look at changes that are happening. These conversations are happening in the hallway, they’re happening in the boardroom, they’re happening during our regular video conference meetings where we’re discussing problems. This problem came up with this employee the other day. This client brought this concern to us about our application. A competitor just entered the market. Did you hear about the phishing email that someone received? These things are being talked about all the time and are being dealt with. They’re just not being formalized; they’re not being documented. So, you are currently involved in risk assessment. You are performing risk assessments. You just have to identify the informal way that you are having these conversations and start looking for ways to document that. If you do have a regular meeting of your management team, if you have regular departmental meetings, start keeping minutes of those meetings and put a section in there titled “Risk,” so that whenever things come up about upgrading something, or improving an approach that you have to a threat or a problem that’s facing your business, you can start documenting the risks that you’re discussing and turn that into a formal, written risk assessment.
Related Videos
A Typical Journey with Risk
Create an Assessment Together
Creating Unity Through Risk Assessment
Definitions for Risk Assessment Components
How Much Time Does An Assessment Take?
How Often Should We Assess Risk
Identifying Assets, Threats, and Vulnerabilities
Just start!
PCI Requirement 12.2 – Implement a Risk Assessment Process
Partner with a Risk Assessment Expert
Preparing for a Risk Assessment
Register for a Risk Assessment Workshop
Risk Assessment Obstacles
Risk Assessment Policy
Risk Assessment Requirements
SOC 2 Academy - How to Manage Risks
SOC 2 Academy - What Types of Risks Does Your Organization Face?
SOC 2 Academy: Assessing Changes Within Your Organization
SOC 2 Academy: Assessing the Significance of Risk
SOC 2 Academy: How Fraud Can Impact Risk
SOC 2 Academy: Risks from Business Partners
SOC 2 Academy: Using a Risk Assessment
SOC 2 Academy: Who Should Make Updates to Your Risk Assessment?
Should I Share Our Risk Assessment
Six Types of Risk
Tips for Getting Started with Risk Assessment
What Are The Steps to Risk Assessment
What Is the Process for Risk Assessment
What Risk Assessment Documentation is Necessary
What Should Be Included in Your Risk Assessment
Who Should Be Involved in the Assessment
