3 Risk Matrix – Adapted from ISO/IEC 31010:2009 Risk Management Risk Assessment Risk Matrix – – Techniques L x C provides a Risk Rating – Consequences Likelihood Insignificant Minor Moderate Major Extreme 1 2 3 4 5 Almost Certain/Very M (05) H (10) H (15) VH (20) CAT (25) Frequent 5 Likely/Frequent 4 M (04) M (08) H (12) H (16) VH (20) Possible 3 L (03) M (06) H (09) H (12) H (15) Unlikely 2 L (02) L (04) M (06) M (08) H (10) Rare 1 L (01) L (02) L (03) M (04) H (05) Table 4 Risk Actions – Risk Rating Risk Actions Description Risk Owner to monitor on a regular basis and Low Accept report on if there is a change in status of its Likelihood or Consequences Risk to monitor the situation and track Accept with Medium performance of controls on a quarterly basis. adequate Controls Management responsibility specified If the potential benefits of an Activity fall within the Accept risk appetite Purpose of UC, consideration is given to accept High to meet Purpose the risk with specified Controls and/or Treatment Plans. Performance to be reviewed quarterly Senior management attention required; Treatment Not Accept risk due High and management responsibility specified. to low tolerance Performance to be reviewed quarterly Senior management attention required; Treatment General Secretary Very High Plan and management responsibility specified. notified or advised Resources Board to be advised Resources Catastrophic Response Plan required notified or advised Table 5 Control Effectiveness –
3 – Risk Matrix Risk Matrix – Adapted from ISO/IEC 31010:2009 Risk Management – Risk Assessment Techniques – L x C provides a Risk Rating Likelihood Consequences Insignificant 1 Minor 2 Moderate 3 Major 4 Extreme 5 Almost Certain/Very Frequent 5 M (05) H (10) H (15) VH (20) CAT (25) Likely/Frequent 4 M (04) M (08) H (12) H (16) VH (20) Possible 3 L (03) M (06) H (09) H (12) H (15) Unlikely 2 L (02) L (04) M (06) M (08) H (10) Rare 1 L (01) L (02) L (03) M (04) H (05) Table 4 – Risk Actions Risk Rating Risk Actions Description Low Accept Risk Owner to monitor on a regular basis and report on if there is a change in status of its Likelihood or Consequences Medium Accept with adequate Controls Risk to monitor the situation and track performance of controls on a quarterly basis. Management responsibility specified High Accept risk appetite to meet Purpose If the potential benefits of an Activity fall within the Purpose of UC, consideration is given to accept the risk with specified Controls and/or Treatment Plans. Performance to be reviewed quarterly High Not Accept risk due to low tolerance Senior management attention required; Treatment and management responsibility specified. Performance to be reviewed quarterly Very High General Secretary notified or advised Senior management attention required; Treatment Plan and management responsibility specified. Resources Board to be advised Catastrophic Resources notified or advised Response Plan required Table 5 – Control Effectiveness
01-Risk-Management-Policy-and-Framework-for-Churches-3.docx