Create a risk statement in the Risk Workspace

Create risk statements to group risks into manageable categories.

Before you begin

Role required: sn_risk.admin

About this task

When you create a risk statement, you can associate entity types or add additional entities to generate risks.

Note: When any of the following risk statement fields changes: Name, Description, Reference, Category, Type, Classification, and Attestation, all the associated controls and risks are updated, and their state is set back to Draft. All the associated risk assessments also get canceled.

Procedure

1. Navigate to All > Risk Workspace > Library > Risk statements.

2. Click New.

3. On the form, fill in the fields.

1. To fill in the fields for the risk appetite section, see Define the risk appetite for a risk statement.

2. If you're using classic risk, in the Default Scores section, fill in the fields.

   Field	Description
   Inherent SLE	Single-loss expectancy (SLE) is the monetary value expected from the occurrence of a risk on an asset if there are no controls to check the event.
   Residual SLE	Monetary value expected from the occurrence of a risk on an asset if there are controls to check the event.
   Inherent ARO	Annualized rate of occurrence (ARO) is an estimated frequency of the threat occurring in one year. ARO is used to calculate annualized loss expectancy (ALE). The value in this field indicates the likelihood of the event occurring if there are no controls to check the event.
   Residual ARO	The value in this field indicates the likelihood of the event occurring if there are controls to check the event.

3. If you're using classic risk with the advanced risk plugin activated, in the Risk Rollup and Tolerance section, fill in the fields.

1. In the Basel Categorization section, select the Basel Categories Hierarchy.

   The Basel categories are as follows:

   • Internal Fraud: misappropriation of assets, tax evasion, intentional mismarking of positions, bribery.
   • External Fraud: theft of information, hacking damage, third-party theft, and forgery.
   • Employment Practices and Workplace Safety: discrimination, workers' compensation, employee health, and safety.
   • Clients, Products, and Business Practice: market manipulation, antitrust, improper trade, product defects, breaches, account churning.
   • Damage to Physical Assets: natural disasters, terrorism, vandalism.
   • Business Disruption and Systems Failures: utility disruptions, software failures, hardware failures.
   • Execution, Delivery, and Process Management: data entry errors, accounting errors, failed required reporting, negligent loss of client assets.
   • Click Save.

2. To add entity types, click the Entity types related list.

   1. Click Add.

   2. Select the entity types to add.

   3. Click Add.

3. To add additional entities, click the Additional entities related list.

   1. Click Add.

   2. Select the entities to add.

   3. Click Add.

4. Click Save.

Result

The risk statement is created.

What to do next

You can continue to add control objectives, indicator templates, and information objects to the risk statement. You can also now assess the risks that are generated in the Risks tab. You can also view the hierarchy of the risks statement on the risk statement side bar. To view the complete risk profile at a glance, click the Overview tab.

Parent Topic:Create a risk framework in the Risk Workspace