Defines the context and scope of a risk assessment, for any area: business objectives, sites, processes, interested parties and constraints, the impact and likelihood scales, the risk evaluation and acceptance criteria and who is responsible for what.
Contents
1. Context and business objectives
2. Scope
3. Interested parties and constraints
4. Impact criteria
5. Likelihood criteria
6. Risk evaluation and acceptance criteria
7. Roles and responsibilities
8. Document control
What you provide
Business objectives — What the organisation must achieve and protect.
Scope of the risk assessment — Only needed if you do not select a scope definition as a source. Activities, information and systems covered.
Sites in scope
Business processes in scope
Interested parties — E.g. “Customers”, “Regulator”, “Cloud provider”.
Constraints — Budget, deadlines, regulatory or technical constraints: one per entry.
Impact criteria to assess
Risks a risk owner may accept — Above this level a risk must be treated, or accepted by management.
Roles and owners — Who is responsible for which area. Owners in the result are taken from here; where no role covers an area, the owner is left for you to fill.
Additional context — Anything the service should take into account.
Title — As it will appear on the result.
Author — Shown as the author of the deliverable; never filled in by the AI.
Sections, in order — The template's sections are proposed, one per line in order: drag to reorder, rename, remove or add.
