Aller au contenu principal

6. Defining Impact Type and Risk Categories

CSFaaS provides the flexibility to define and customise Impact Types and Risk Categories to align with your organisation’s unique structure, industry, and strategic objectives. While the platform includes predefined catalogues based on internationally recognised standards, you can adapt these settings to reflect your specific risk management needs.

By leveraging this flexibility, CSFaaS empowers you to build a risk management framework that aligns with your strategic goals and operational needs while maintaining consistency with global standards.


Impact Types​

Impact Types specify the areas where risks can affect your organisation, helping you evaluate and prioritise potential consequences. CSFaaS provides the following predefined Impact Types:

  • Asset and Fraud: Risks related to the loss, theft, or misuse of physical or digital assets, including fraud-related activities.
  • Brand Damage: Threats to your organisation’s reputation, customer trust, or public perception.
  • Business Disruption: Interruptions to operations, services, or critical business processes.
  • Operating Costs: Risks that result in increased expenses or reduced operational efficiency.
  • Legal and Regulatory: Risks associated with non-compliance, regulatory fines, or legal disputes.
  • Competitive Advantage: Loss of market position or competitive edge due to strategic risks or failures.
  • Response and Recovery: Costs and challenges associated with responding to and recovering from incidents.
  • People: Risks affecting employees, such as health and safety concerns, retention, or morale.

These predefined types can be customised to reflect your organisation’s unique context. For example, you can add additional types specific to your industry or refine descriptions to better align with internal terminology and risk tolerance.


Risk Categories​

Risk Categories group risks into logical clusters, making it easier to monitor trends, assign ownership, and prioritise mitigation efforts. The predefined categories in CSFaaS include:

  • Strategic Risks: Risks that affect long-term objectives and strategic goals.
  • Operational Risks: Risks arising from day-to-day processes and activities.
  • Tactical Risks: Risks that impact financial stability, resource allocation, or growth initiatives.
  • Compliance: Risks associated with regulatory, contractual, or legal obligations.

Customisation Options​

CSFaaS provides flexibility to adapt these categories to your organisation's unique needs:

  • Customise Categories: Modify or add categories to reflect specific operational areas or industry requirements.
  • Expand Coverage: Introduce new dimensions of risk to ensure comprehensive identification and tracking.

Customising these categories allows for a more precise alignment with your organisation’s structure, enabling better risk ownership, monitoring, and response.


Standard Catalogues vs Customized Catalogs​

In the initial stages, you can rely on the predefined catalogues provided by CSFaaS, which are rooted in internationally recognised frameworks. However, as your organisation evolves, these catalogues can be customised to ensure they fully align with your unique context and priorities.

Best Practices for Customisation​

  • Collaborate with Stakeholders: Involve senior leadership, risk managers, and department heads to ensure customisations align with organisational priorities.
  • Maintain Clarity: Use clear and descriptive labels for each Impact Type and Risk Category to avoid confusion during risk assessments.
  • Regular Updates: Periodically review and refine your catalogues to reflect changing risks and organisational objectives.