Focus area · Risk
Risk, measured in the value it threatens.
Every risk is attached to the assets it threatens. Its impact is a loss of Vi, its appetite is a line on the same scale, and its priority follows the value at stake.
The problem
A heat map colours risks. It does not rank them.
Likelihood times impact on a five-by-five grid puts dozens of risks in the same red box, and the board still cannot tell which one threatens the most.
Impact by opinion
High, medium and low mean different things to different assessors, so scores cannot be compared.
Risks without assets
Registers list risks in the abstract, detached from the systems and services they threaten.
Appetite on paper
Risk appetite is a statement in a policy, not a line anyone can measure against.
The VGF lens
Risk maturity, on the assets that carry value.
Risk Management is the first of the four core competencies of the framework. Its six dimensions are assessed on each relevant asset, on the same 0–5 scale.
How the platform does it
The life of a risk, on the value scale.
Identify, assess, treat, monitor and reassess, with impact expressed as a loss of Vi and appetite drawn on the same scale.
Modules at work
What each part of the platform contributes.
Register and treatment
Risks raised on real assets, assessed, treated and monitored, with owners and due dates.
What a risk reaches
A risk on one component reaches the services and capabilities above it, with their value.
Treatment plans
Treatments become tracked actions, and their closure updates the risk.
Incidents as evidence
Real incidents update likelihood and show which controls did not hold.
Go deeper
Risk Management Competency Framework
Identification to risk culture: the six dimensions and how they apply to each asset type.
Executive Overview
The framework, the formula and how to start, in a short read.
How value is measured
Ci, Mi, Vi and the value lost in an incident, step by step.
See your risks ranked by value at stake.
A walkthrough on sample data: a risk raised on an asset, its loss of Vi, the appetite line and the treatment that follows.