Attachment 2 Risk Controls Criteria – City of Stonnington - RISK CRITERIA Measuring Risk: CONTROLS INFORMATION CONTROL RATING DESCRIPTION SYSTEM CONTROL/DESIGN CONTINGENCY PLAN SYSTEM Effectiveness of existing Reduces severity of consequence of Supports the action and Affects frequency of occurrence control measures an event capability for monitoring Total confidence. Well proven data base, Significant control over the Excellent system with total Total confidence in an effective plan. robust system, very user TOTALLY EFFECTIVE risk. implementation. Fully tested and documented. friendly. No variance in control quality. Very confident. Mainly as above but Substantial reduction in risk. Full system with effective Very confident. improvements are VERY EFFECTIVE Improvements are possible. implementation. Fully tested and documented. possible. Little or no variance in control quality. Just effective - open to some Mostly good but not yet Quite confident. Satisfactory risk reduction. weaknesses. robust. Some in EFFECTIVE Satisfactorily implemented. Improvements are possible. Not fully tested, quite good supporting effective risk Some variance in control quality. documentation. action. Moderately confident. Fair to poor database / Marginal risk reduction. Not really effective plan. Fair implementation only. performance in risk PARTIALLY EFFECTIVE Improvements should be Not tested open to substantial – Quite a degree of variance in reduction. Not very user considered. problems. performance. friendly. Not confident. Minimal risk reduction, if any. No plan at all or very inadequate Very poor / inadequate / INEFFECTIVE Only partly introduced or no attempt. Improvements required. preparation. nonexistent. Substantial variance. Process Consider the effectiveness of current controls when determining the three levels of risk. The rating given should be based on the lowest of control ratings applied.
Attachment 2 – Risk Controls Criteria City of Stonnington - RISK CRITERIA Measuring Risk: CONTROLS CONTROL RATING DESCRIPTION SYSTEM CONTROL/DESIGN CONTINGENCY PLAN INFORMATION SYSTEM Effectiveness of existing control measures Affects frequency of occurrence Reduces severity of consequence of an event Supports the action and capability for monitoring TOTALLY EFFECTIVE Significant control over the risk. Total confidence. Excellent system with total implementation. No variance in control quality. Total confidence in an effective plan. Fully tested and documented. Well proven data base, robust system, very user friendly. VERY EFFECTIVE Substantial reduction in risk. Improvements are possible. Very confident. Full system with effective implementation. Little or no variance in control quality. Very confident. Fully tested and documented. Mainly as above but improvements are possible. EFFECTIVE Satisfactory risk reduction. Improvements are possible. Quite confident. Satisfactorily implemented. Some variance in control quality. Just effective - open to some weaknesses. Not fully tested, quite good documentation. Mostly good but not yet robust. Some in supporting effective risk action. PARTIALLY EFFECTIVE Marginal risk reduction. Improvements should be considered. Moderately confident. Fair implementation only. Quite a degree of variance in performance. Not really effective plan. Not tested – open to substantial problems. Fair to poor database / performance in risk reduction. Not very user friendly. INEFFECTIVE Minimal risk reduction, if any. Improvements required. Not confident. Only partly introduced or no attempt. Substantial variance. No plan at all or very inadequate preparation. Very poor / inadequate / nonexistent. Process Consider the effectiveness of current controls when determining the three levels of risk. The rating given should be based on the lowest of control ratings applied.
risk-management-policy-2013-2015-review.docx