What problem does it solve?
Without a formal assessment, priorities are set by the latest incident, a vendor's recommendation or individual perception. That leads to unbalanced investments and critical risks without an owner.
Who is it for?
- Boards of directors and audit and risk committees
- Risk, compliance and internal audit management
- Regulated companies or those responding to customer requirements
What risks does it address?
- Critical risks without an assigned owner
- Undefined risk appetite
- Treatments that are neither executed nor measured
What's included?
- Context and risk criteria workshop with leadership
- Inventory of critical processes and assets
- Matrix of physical, technological and human risks
- Treatment plan with owners, deadlines and indicators
- Executive presentation for the board
Business benefits
- Prioritization you can defend before the board
- Clear assignment of owners
- A foundation for business continuity and compliance
Methodology
Understand
Business context, critical processes and risk appetite, with leadership.
Assess
Review of physical and digital controls and behaviors, with evidence.
Prioritize
Findings ranked by impact and effort, with owners.
Implement
Support with actions, procedures and training.
Measure and improve
Executive indicators and periodic review.
Scope, duration and the financial proposal are defined after an initial conversation, according to the size and needs of the organization.
Frequently asked questions
What methodology do you use?
We adapt recognized risk management practices (for example, the ISO 31000 family and ISO/IEC 27005) to the organization's size and maturity.
How often should it be updated?
As a reference, at least once a year and whenever there are relevant changes: new sites, systems, suppliers or incidents.