If risk is not accepted, complete risk mitigation (action) plan: Action to reduce risk Responsibility Timescale Revised risk score Evaluating Information Risk / Risk rating for Information Risk Assessments A simple approach to quantifying risk is to define qualitative measures of consequences and likelihood such as the exemplars given below. This allows construction of a risk matrix which can be used as the basis of identifying acceptable and unacceptable risk. In order to prioritise actions, it is necessary to evaluate the level of risk presented by each of the identified hazards. This is done using a simple rating system (1-5). First, for each of the hazards/risks decide how likely it is to happen (Likelihood) and how serious the consequences are most likely to be (Severity) from the following guide, taking into account the measures already in place. RISK SCORE LEVEL ACTION AND TIMESCALE INSIGNIFICANT No action is required to deal with trivial risks, and Slight damage to property or equipment, Slight no documentary records need to be kept. delay in service provision, an element of financial loss, minor clinical incident no – immediate effect on patient safety or patient care, potential breach of confidentiality where less than 5 people affected or risk assessed as low, e.g. files were encrypted. No further preventive action is necessary, but Slight damage to property or equipment, Slight consideration should be given to more solutions, or improvements that impose delay in service provision, an element of no additional cost burden. financial loss, minor clinical incident no – Monitoring is required to ensure that the controls immediate effect on patient safety or patient are maintained. care, Loss of availability to authorised users, Serious potential breach of confidentiality e.g.
If risk is not accepted, complete risk mitigation (action) plan: Action to reduce risk Responsibility Timescale Revised risk score Evaluating Information Risk / Risk rating for Information Risk Assessments A simple approach to quantifying risk is to define qualitative measures of consequences and likelihood such as the exemplars given below. This allows construction of a risk matrix which can be used as the basis of identifying acceptable and unacceptable risk. In order to prioritise actions, it is necessary to evaluate the level of risk presented by each of the identified hazards. This is done using a simple rating system (1-5). First, for each of the hazards/risks decide how likely it is to happen (Likelihood) and how serious the consequences are most likely to be (Severity) from the following guide, taking into account the measures already in place. RISK SCORE LEVEL ACTION AND TIMESCALE INSIGNIFICANT Slight damage to property or equipment, Slight delay in service provision, an element of financial loss, minor clinical incident – no immediate effect on patient safety or patient care, potential breach of confidentiality where less than 5 people affected or risk assessed as low, e.g. files were encrypted. No action is required to deal with trivial risks, and no documentary records need to be kept. Slight damage to property or equipment, Slight delay in service provision, an element of financial loss, minor clinical incident – no immediate effect on patient safety or patient care, Loss of availability to authorised users, Serious potential breach of confidentiality e.g. No further preventive action is necessary, but consideration should be given to more solutions, or improvements that impose no additional cost burden. Monitoring is required to ensure that the controls are maintained.
IGAssuranceFramework.docx