I am working on an isms implementation for iso 27001:2013. So far whatever risk assessment approaches i have used asset based in which methodology focuses on asset value evaluation, threats, vulnerability and control implementation status values to calculate the risk associated with underlying asset. Lately i have came across a business process based risk assessment. i have searched on google and have found few helpful sites although couldn't manage to find anything concrete in terms of risk assessment methodology one can adopt or relevant templates. looking for help to come up with a formula in process based approach for risk assessment or any sample templates will be greatly appreciated.Thanks in advance.
closed as too broad by Neil Smithline, Tobi Nary, Steffen Ullrich, kalina, Ohnana Apr 17 '16 at 21:27
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
Normally, the risk analysis is process based: You go through the main business processes with the client and then for each process you should find relative assets. For each asset, the impact on the business processes should be clearly defined in case of asset disruption: no impact, low impact, medium impact, high impact and also highlighting the vulnerabilities for each asset. The importance of an asset should be defined according to the importance of the business processes and the impact of this asset.
You have the possibility to abstract process risks and the evaluation of them from your asset risks. My definition of process would be "description of business tasks (process 1 would be something like order process management)"
For this approach you would have to sit with the process owner and identify risks that threaten to prevent the intended outcome of the process. The identified risks can be evaluated by probability of occurrence and impact. The process owner than would have to evaluate something like that:
- probability of occurrence
- financial loss if risk occurs (in hardware damage)
- loss in reputation (if you are interested in that kind of thing)
- financial loss because of violation of contracts or the law
You can put up a matrix typical for quantitative risk assessment (one axis for probabillity of occurrence, one for a combination of the evaluated impact) and categorize all the risks on that basis. This would give you the flexibility to establish a matrix on your own (which is fine for iso 27001:2013!) and covering individual risks that can be defined by the people who actually know the process best.