3.5 Developing a Risk Action Plan
Risk practitioners should play a consultative role in assisting risk owners and help them to decide appropriate risk responses.
Final decision on risk response should be taken by the risk owner but risk practitioners should guide him on technologies, policies, procedures, control effectiveness and leveraging of existing controls.
If the current risk is above the risk appetite of the organization, then a further risk response is required to bring down the level of risk.
Different alternatives for risk response are evaluated and analyzed. Risk responses are prioritized by considering the cost-benefit analysis of each alternative.
Once a risk response is finalized, a risk action plan is created and documented in the risk register. Risk action plan should include a start date, end date, details about strategy, details about the responsible person or team.
For effective implementation of an action plan, it is recommended to assign the responsibility of implementing the action plan to concerned individuals along with timelines for the implementation. Other options are not as effective as option D.
Risk action plan should be considered as a project. Critical paths of the project should be properly monitored because delays in these elements increase overall project risk.
Implemented control should be reviewed at frequent intervals to ensure that identified risk is kept at an acceptance level.
Key aspects from CRISC exam perspective
|
CRISC Question
|
Possible Answer
|
|
How to ensure that identified risk is kept at an acceptable level?
|
Periodic
review of the control
|
|
Risk action
plan must include
|
·
Start data
·
End data
·
Responsible person
·
Detail action plan
|