Has your organisation identified the key risks across the business, assessed the severity and likelihood of them occurring, implemented mitigating controls and calculated the residual risk remaining after the mitigation?
Is the board happy with the level of residual risk or do they want more mitigations to be found?
Has the risk/ cost ratio for the mitigation been calculated?
Are the key risks and mitigations monitored over time by an assigned ‘risk owner’?
If the answer is ‘no’ to any of the questions above, then we can assist by: