Step 1: Identify your risks

From multiple perspectives, you want to identify your risks while implementing of standards such as the ISO 27001 and NO 7510. Think of stakeholders, but you can also examine your organization's objectives and business processes. Sometimes it is difficult to make these risks immediately visible. One method to get more input into your risks is the so-called Nominal Group Technique (NGT). NGT is a type of brainstorming session where you let everyone write down risks individually. All risks are then included in a list and you discuss and rank them together. This provides more input than a traditional brainstorm and prevents “strong” employees from just doing the talking. Furthermore, it is crucial that you take the time to do so even more awareness to create within your organization.

‍

Step 2: Set assessment criteria based on the risks

After you have identified the risks, it is important to set assessment criteria for the risks found. Questions such as:

• How urgent is a risk?
• And what criteria do you attach to that?
• Based on impact or frequency?

Impact (Large, medium and small) and frequency (continuous, daily, weekly, etc.) are often used, but don't hesitate to add your own criteria.

‍

Step 3: Set up a treatment procedure against the identified risks

After setting assessment criteria, you as an organization must use a treatment procedure as part of your risk analysis. A treatment procedure can be seen as a type of intervention for treating the risks within your organization. This includes measures that determine who, what and when does with regard to the risks. This is important to encourage ownership.

Remember: if everyone is responsible, no one is responsible. This also ensures that you do not overlook risks and know how to approach them.

‍

Step 4: Stay critical of your risk analysis!

Finally, it is important (as always) to remain critical. It is recommended to plan fixed times to consider the functioning of the risk analysis and associated procedures. This ensures a pragmatic and effective approach to risk analysis.

‍

In short

In short, risk analysis is an important part of ISO standards. It appears in every standard and can be a fundamental part of your business. Especially in turbulent and radical times. Sometimes, as an organization, you have to change course, but this must be done responsibly to create awareness within the organization. If you don't keep looking at the obstacles and dangers, this can have crucial consequences for your business continuity. So all in all, stay alert and always analyze your risks in order to be aware of what is happening around you as an organization. This way, you are always one step ahead of any danger, after all, prevention is better than cure!