Manual Risk Acceptance

Risk acceptance occurs when a company or individual acknowledges that the potential loss from a risk is not great enough to justify the expense of avoiding it. The Cetbix risk acceptance feature enables risk sharing.

Cetbix Manual Risk Acceptance

Cetbix GRC / ISMS provides both manual and digital risk acceptance options as part of its risk management features. For manual risk acceptance:

• Risk Assessment: The system allows for identification, analysis, and evaluation of risks.
• Risk Acceptance Criteria: Organizations can define risk acceptance criteria in advance.
• Risk Comparison: Identified risks are compared against the predefined acceptance criteria.
• Decision Making: Based on the comparison, decisions can be made on whether to accept specific risks.
• Documentation: Accepted risks are documented in the risk register, including details such as risk type, causes, and effects.
• Risk Monitoring: Accepted risks are monitored with reminder notifications and workflows.
• Reporting: The system provides predefined risk reports and allows creation of custom reports using a Report Designer.
• Multi-entity Support: Risk acceptance can be managed across multiple branches, locations, and entities from a single dashboard.
• Integration: Risk acceptance is integrated with other ISMS components like the Internal Control System (ICS).
• Methodology Options: Organizations can use default or customized methodologies for risk level acceptance.

The manual risk acceptance process in Cetbix GRC / ISMS allows for human judgment in decision-making while providing structured tools and processes to support informed risk acceptance choices.

How Cetbix GRC / ISMS integrate risk acceptance into its methodology

Cetbix GRC / ISMS integrates risk acceptance into its methodology through several key features:

• Risk Assessment Process: Cetbix GRC / ISMS enables organizations to identify, analyze, and evaluate risks, including their probability of occurrence and potential effects.
• Predefined Risk Acceptance Criteria: The system allows organizations to define risk acceptance criteria in advance, against which identified risks are compared.
• Decision Support: Based on the comparison with acceptance criteria, Cetbix ISMS supports decision-making on whether to accept specific risks.
• Documentation: Accepted risks are documented in the risk register, including details such as risk type, causes, and effects.
• Monitoring: The system provides risk monitoring capabilities with reminder notifications and workflows for accepted risks.
• Reporting: Cetbix offers predefined risk reports and a Report Designer for creating custom reports on risk acceptance.
• Integration: Risk acceptance is integrated with other ISMS components, such as the Internal Control System (ICS).
• Multi-entity Support: Risk acceptance can be managed across multiple branches, locations, and entities from a single dashboard.
• Methodology Options: Organizations can use default or customized methodologies for risk level acceptance.
• Continuous Assessment: Cetbix GRC / ISMS supports ongoing monitoring and improvement, allowing for regular review and reassessment of accepted risks.

By incorporating these features, Cetbix GRC / ISMS provides a comprehensive approach to risk acceptance within its overall risk management methodology.

How Cetbix GRC / ISMS define risk acceptance criteria

Cetbix GRC / ISMS allows organizations to define risk acceptance criteria in advance as part of its risk management methodology. Key aspects of how Cetbix GRC / ISMS handles risk acceptance criteria include:

• Customizable Criteria: Organizations can set their own risk acceptance criteria aligned with their risk appetite and tolerance.
• Structured Approach: The system enables implementing risk scoring, where a particular score can be set as the threshold for risk acceptance.
• Management Override: While following a structured approach, Cetbix ISMS allows the Management Review Team or Senior Management Team to override and accept risks outside the predefined criteria.
• Integration with Risk Assessment: The defined risk acceptance criteria are used for comparison during the risk assessment process.
• Multi-entity Support: Risk acceptance criteria can be managed across multiple branches, locations, and entities from a single dashboard.
• Documentation: The system maintains records of the defined risk acceptance criteria and decisions made based on them.
• Regular Review: As part of the continuous assessment process, risk acceptance criteria can be regularly reviewed and updated.

By providing these features, Cetbix GRC / ISMS enables organizations to establish clear, consistent, and flexible risk acceptance criteria that align with their overall risk management strategy.

Methods used by Cetbix GRC / ISMS to quantify risk tolerance

Cetbix ISMS uses several methods to quantify risk tolerance:

• Risk Scoring: The system implements a risk scoring approach where organizations can set specific thresholds for risk acceptance[1].

• Monte Carlo Analysis: Cetbix uses Monte Carlo analysis to analyze identified risks with regard to their probability of occurrence and possible effects[1].

• Quantitative Risk Metrics: The system calculates several quantitative risk metrics, including:

  - Single-Loss Expectancy (SLE)
  - Annualized Loss Expectancy (ALE)
  - Annualized Rate of Occurrence (ARO)
  - Benefit/Cost Ratio
  - Return On Investment (ROI)
  - Payback Period
  - Net Present Value (NPV)
  - Internal Rate of Return (IRR)[1]

• Asset Quantification: Cetbix ISMS allows for quantification of risks associated with specific assets[1].

• Risk Categorization and Aggregation: The system supports categorizing and aggregating risks, which can help in determining overall risk tolerance levels[1].

• 3D Risk Management Dashboard: Cetbix provides a visual representation of risk data, allowing for easier interpretation of risk tolerance levels[1].

• Customizable Reporting: The system offers predefined risk reports and a Report Designer for creating custom reports, enabling organizations to tailor risk tolerance reporting to their specific needs[1][2].

These methods allow organizations using Cetbix ISMS to quantify their risk tolerance in a comprehensive and flexible manner, supporting informed decision-making in risk management.

Citations:

• [1] https://www.capterra.com/p/188395/Cetbix-Information-Security-Management-System/
• [2] https://sourceforge.net/software/product/Cetbix-ISMS/