{"text_format":"1","workbook":"xlsx","n_sheets":5,"sheets":["Risk Register","Risk Assessment Matrix","Lookup Values","Individual Risk Assessment","Risk Summary Report"],"not_rendered":{"charts":0,"images":0,"macros":0,"external_links":0,"defined_names":6,"comments":1,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Risk Register","index":0,"n_rows":17,"n_cols":18,"rows_kept":17,"cut":false,"hidden":false,"merged":[[14,1,16,1],[14,2,16,2],[14,3,16,3],[14,4,16,4],[14,5,16,5],[14,6,16,6],[14,7,16,7],[8,8,10,8],[8,16,10,16],[8,17,10,17],[11,6,13,6],[11,7,13,7],[14,8,16,8],[14,16,16,16],[14,17,16,17],[11,8,13,8],[11,16,13,16],[11,17,13,17],[11,1,13,1],[11,2,13,2],[11,3,13,3],[11,4,13,4],[11,5,13,5],[5,6,7,6],[5,7,7,7],[5,16,7,16],[5,17,7,17],[8,1,10,1],[8,2,10,2],[8,3,10,3],[8,4,10,4],[8,5,10,5],[8,6,10,6],[8,7,10,7],[5,1,7,1],[5,2,7,2],[5,3,7,3],[5,4,7,4],[5,5,7,5],[0,1,0,17],[2,1,2,17],[3,1,4,1],[3,2,3,3],[3,4,4,4],[3,5,4,5],[3,6,4,6],[3,7,4,7],[3,8,4,8],[3,9,3,12],[3,14,3,15],[3,16,4,16],[3,17,4,17]]}
[null,"Example Risk Register"]
[]
[null,"Risk Register"]
[null,"Risk ID","Assessment",null,"Risk description","Objective (s) Affected","Consequence Type(s)","Risk Owner","Causes","Risk Ratings",null,null,null,"Accept risk?","Controls/Risk Treatment",null,"Review and reporting requirements","Comments"]
[null,null,"By","Date (DD/MM/YYYY)",null,null,null,null,null,"Case","C","L","Risk level",null,"Description","Control Effectiveness"]
[null,null,null,null,null,null,{"$f":"\"-financial\n-service delivery\n\nNote that these should be aligned to your consequence table\"","v":"-financial\n-service delivery\n\nNote that these should be aligned to your consequence table"},"Include name of the person managing the risk and the area of the organisation they work in.  \n\nIf the risk owner is different o the person assigned to treat the risk you should include their details",null,"Worst  case",null,null,null,null,"current controls ",null,"How and when the risk and controls are to be reviewed and reported?","Uncertainties or sensitivities - are the risks that you have identified making the achievement of your agency’s objectives too uncertain?\n\nResources required – financial physical, human resources"]
[null,null,null,null,null,null,null,null,null,"Current",null,null,"Level of risk remaining after the application of existing  controls","Is the risk acceptable/ tolerable?","Additional treatment if the risk is not acceptable/ tolerable\nTiming"]
[null,null,null,null,null,null,null,null,null,"Residual",null,null,"Expected level of risk remaining after risk treatments","Is the risk acceptable/tolerable?"]
[null,"ICT-001",null,null,"Loss of Confidentiality",null,"Service Delivery,\nReputation and Image,\n","CIO,\n\nCSO assigned to risk treatment projects.","Identity and Access Management (IAM) systems compromised\n\nSystems are susceptible to intrusion from external sources due to web applications supported by out of date operating systems","Worst  case","Major","Almost Certain",{"$f":"INDEX(Risk_Values,MATCH('Risk Register'!L9&'Risk Register'!K9,Likelihood&Consequence,0))","v":"High"},null,"Manual forms, regular audit checks against HR systems.\n\nManual audit of patching and OS versions.",null,"Cyber intrusions and other events reported monthly to Corporate Executive,","Additional financial support required to implement new services is required.\n\nCurrent staff skills require updating with training in new systems and processes."]
[null,null,null,null,null,null,null,null,null,"Current","Major","Possible",{"$f":"INDEX(Risk_Values,MATCH('Risk Register'!L10&'Risk Register'!K10,Likelihood&Consequence,0))","v":"High"},"No, treatment required","Implement automated IAM systems and Multiform Authentication where required\n\nComplete Update of new Application Architecture.\n\nData encryption at rest and in transit implemented for all systems.\n\nISO 27001 based Framework and associated relevant controls implemented.","Adequate"]
[null,null,null,null,null,null,null,null,null,"Residual","Major","Remote",{"$f":"INDEX(Risk_Values,MATCH('Risk Register'!L11&'Risk Register'!K11,Likelihood&Consequence,0))","v":"Medium"},"Yes, risk acceptable post treatment plans",null,"Excellent"]
[null,"ICT-002",null,null,"Loss of Integrity",null,"Service Delivery,\nReputation and Image,\nOperational Efficiency","CIO,\n\nInfrastructure Manager assigned to risk treatment projects.","Backup and recovery services are not documented and untested.\n\nCritical Systems are supported by out of date infrastructure and operating systems, resulting in database corruptions","Worst  case","Major","Almost Certain",{"$f":"INDEX(Risk_Values,MATCH('Risk Register'!L12&'Risk Register'!K12,Likelihood&Consequence,0))","v":"High"},null,"Ad-hoc recovery of services as and when they fail",null,"Backup and recovery capability to be reported monthly to CIO.\n\nTreatment plan program progress reported to CIO on monthly basis.","Additional financial support required to implement new services is required.\n\nCurrent staff skills require updating with training in new systems and processes."]
[null,null,null,null,null,null,null,null,null,"Current","Major","Almost Certain",{"$f":"INDEX(Risk_Values,MATCH('Risk Register'!L13&'Risk Register'!K13,Likelihood&Consequence,0))","v":"High"},"No, treatment required","Document and Test Backup and Recovery services.\n\nMigrate systems to new Infrastructure.\n\nISO 27001 based Framework and associated relevant controls implemented.","Inadequate"]
[null,null,null,null,null,null,null,null,null,"Residual","Major","Unlikely",{"$f":"INDEX(Risk_Values,MATCH('Risk Register'!L14&'Risk Register'!K14,Likelihood&Consequence,0))","v":"Medium"},"Yes, risk acceptable post treatment plans",null,"Excellent"]
[null,"ICT-003",null,null,"Loss of Availability",null,"Service Delivery,\nReputation and Image,\nOperational Efficiency.","CIO,\n\nInfrastructure Manager assigned to risk treatment projects.","Critical Systems are supported by out of date infrastructure and operating systems, resulting in numerous outages and untreatable cyber security intrusions.\n\nCurrent infrastructure is not architected for high availability.\n\nLack of Disaster Recovery facilities that will meet  Recovery Time and Point Objective requirements","Worst  case","Extreme","Almost Certain",{"$f":"INDEX(Risk_Values,MATCH('Risk Register'!L15&'Risk Register'!K15,Likelihood&Consequence,0))","v":"Very High"},null,"Nil",null,"Critical incidents reported to CIO and Corporate Executive on a monthly basis.","Additional financial support required to implement new services is required.\n\nCurrent staff skills require updating with training in new systems and processes."]
[null,null,null,null,null,null,null,null,null,"Current","Extreme","Possible",{"$f":"INDEX(Risk_Values,MATCH('Risk Register'!L16&'Risk Register'!K16,Likelihood&Consequence,0))","v":"Very High"},"No, treatment required","Migrate systems to new Infrastructure.\n\nCommission DR services to meet RTO & RPO  requirements\n\nISO 27001 based Framework and associated relevant controls implemented.","Inadequate"]
[null,null,null,null,null,null,null,null,null,"Residual","Major","Remote",{"$f":"INDEX(Risk_Values,MATCH('Risk Register'!L17&'Risk Register'!K17,Likelihood&Consequence,0))","v":"Medium"},"Yes, risk acceptable post treatment plans",null,"Excellent"]

{"sheet":"Risk Assessment Matrix","index":1,"n_rows":41,"n_cols":12,"rows_kept":41,"cut":false,"hidden":false,"merged":[[34,4,34,5],[14,4,14,5],[15,4,15,5],[16,4,16,5],[17,4,17,5],[18,4,18,5],[30,4,30,5],[32,4,32,5],[22,4,22,5],[23,4,23,5],[24,4,24,5],[25,6,25,7],[33,6,33,7],[33,4,33,5],[22,6,22,7],[24,6,24,7],[26,6,26,7],[29,6,29,7],[30,6,30,7],[31,6,31,7],[32,6,32,7],[34,6,34,7],[4,4,4,8],[40,5,40,7],[40,8,40,9],[38,5,38,7],[38,8,38,9],[39,5,39,7],[39,8,39,9],[37,5,37,7],[37,8,37,9],[21,4,21,5],[21,9,21,10],[31,4,31,5],[25,4,25,5],[26,4,26,5],[23,6,23,7]]}
[null,null,null,"Risk Analysis Matrix"]
[]
[null,null,null,"Table 1:  Qualitative Risk Analysis Matrix"]
[]
[null,null,null,null,"CONSEQUENCE"]
[null,null,null,"LIKELIHOOD","Insignificant","Negligible","Moderate","Major","Extreme"]
[null,null,null,"Remote","Very Low","Very Low","Low","Medium","High"]
[null,null,null,"Unlikely","Very Low","Low","Medium","Medium","High"]
[null,null,null,"Possible","Very Low","Low","Medium","High","Very High"]
[null,null,null,"Likely","Very Low","Low","Medium","High","Very High"]
[null,null,null,"Almost Certain","Low","Low","Medium","High","Very High"]
[]
[null,null,null,"Table 2:  Risk Acceptance Criteria Table"]
[null,null,null,"RISK RATING","Acceptance Level",null,"Control Level","Monitoring","Reporting","RESPONSIBILITY"]
[null,null,null,"Very Low","Acceptable",null,"Adequate","Passive","By exception","Tier 5 (Line Management)"]
[null,null,null,"Low","Acceptable",null,"Adequate","Active","Quarterly/Yearly","Tier 4 (Senior Management)"]
[null,null,null,"Medium","Acceptable",null,"Adequate","Active","Monthly/Quarterly","Tier 3 (Executive Management)"]
[null,null,null,"High","Acceptable is some circumstances",null,"Excellent","Pro-Active","Weekly/Monthly","Tier 2 (Senior Executive Management)"]
[null,null,null,"Very High","Unacceptable in most circumstances",null,"Excellent","Pro-Active","Daily/Weekly","Tier 1 (Director General)"]
[]
[null,null,null,"Table 3:  Qualitative Measures of Likelihood"]
[null,null,null,"LEVEL","DESCRIPTION",null,"FREQUENCY",null,"%","COMMENT"]
[null,null,null,"Remote","Less than once in 5 years",null,"Extremely low probability. Will only occur in exceptional circumstances",null,"< = 10%"]
[null,null,null,"Unlikely","At least once in 5 years",null,"Low probability of an incident",null,"> 10% <= 25%"]
[null,null,null,"Possible","At least once in 3 years",null,"Moderate probability of an incident",null,"> 25% <= 50%"]
[null,null,null,"Likely","Once per year",null,"Probably will occur",null,"> 50% <= 75%"]
[null,null,null,"Almost Certain","More than once per year",null,"Expected to occur in most circumstances",null,"> 75%"]
[]
[null,null,null,"Table 4:  Qualitative Measures of Consequence"]
[null,null,null,"RANK","INJURIES",null,"FINANCIAL LOSS",null,"SERVICE DELIVERY INTERRUPTION","REPUTATION - IMAGE","OPERATIONAL EFFICIENCY ","STATUTORY"]
[null,null,null,"Insignificant","Minor injuries not requiring first aid treatment, or near miss",null,"Less than $50,000, or 0.025% of operational budget",null,"Less than 1 hour","Little community interest, low profile, no news items","Little impact","No noticeable statutory or regulatory impact"]
[null,null,null,"Negligible","First aid treatment",null,"$50,000 to $250,000, or 0.15% of operational budget",null,"1 - 7.5 hours","Low impact, some passing interest, low news profile","Inconvenient delays","Minor/temporary non-compliance with statutory requirements"]
[null,null,null,"Moderate","Medical treatment required",null,"$250,000 to $3 million, or 2% of operational budget",null,"1 day to 1 week","Moderate impact, moderate public interest, public embarrassment, moderate news profile","Delays in major service deliverables","Short-term non-compliance with moderate statutory requirements"]
[null,null,null,"Major","Serious or extensive injuries",null,"$3 million to $10 million, or 6% of operational budget",null,"1 week to 1 month","Sustained public interest, high negative news profile, Premier/Cabinet publicly involved, third party action","Non-achievement of a major deliverable","Significant non-compliance with essential statutory requirements"]
[null,null,null,"Extreme","Deaths or severe permanent disablements",null,"More than $10 million, or more than 6% of operational budget",null,"more than 1 month","Widespread public agitation, Government censure, high multiple impacts, widespread negative news profile","Non-achievement of major key corporate objectives","Long term or indefinite non-compliance with essential statutory requirements and may result in criminal charges"]
[]
[null,null,null,"Table 5:  Existing Controls                 "]
[null,null,null,"LEVEL","RATING","COMMENT",null,null,"EXAMPLE"]
[null,null,null,"E","Excellent","More that what a reasonable person would be expected to do in the circumstances",null,null,"Appropriate controls in place require only maintenance and monitoring"]
[null,null,null,"A","Adequate","Only what a reasonable person would be expected to do in the circumstances",null,null,"Existing systems and procedures cover known circumstances and provide reasonable assurance for majority of events"]
[null,null,null,"I","Inadequate","Less that what a reasonable person would be expected to do in the circumstances",null,null,"No systems and procedures in place, or existing systems and procedures are obsolete and require review"]

{"sheet":"Lookup Values","index":2,"n_rows":29,"n_cols":4,"rows_kept":29,"cut":false,"hidden":true,"merged":[]}
[]
[]
[]
[null,"Likelihood","Consequence","Risk Level"]
[null,"Remote","Insignificant","Very Low"]
[null,"Remote","Negligible","Very Low"]
[null,"Remote","Moderate","Low"]
[null,"Remote","Major","Medium"]
[null,"Remote","Extreme","High"]
[null,"Unlikely","Insignificant","Very Low"]
[null,"Unlikely","Negligible","Low"]
[null,"Unlikely","Moderate","Medium"]
[null,"Unlikely","Major","Medium"]
[null,"Unlikely","Extreme","High"]
[null,"Possible","Insignificant","Very Low"]
[null,"Possible","Negligible","Low"]
[null,"Possible","Moderate","Medium"]
[null,"Possible","Major","High"]
[null,"Possible","Extreme","Very High"]
[null,"Likely","Insignificant","Very Low"]
[null,"Likely","Negligible","Low"]
[null,"Likely","Moderate","Medium"]
[null,"Likely","Major","High"]
[null,"Likely","Extreme","Very High"]
[null,"Almost Certain","Insignificant","Low"]
[null,"Almost Certain","Negligible","Low"]
[null,"Almost Certain","Moderate","Medium"]
[null,"Almost Certain","Major","High"]
[null,"Almost Certain","Extreme","Very High"]

{"sheet":"Individual Risk Assessment","index":3,"n_rows":30,"n_cols":5,"rows_kept":30,"cut":false,"hidden":false,"merged":[[29,1,30,1],[29,2,30,2],[29,3,30,3],[29,4,30,4],[17,1,17,4],[23,1,23,4],[24,2,24,3],[26,1,26,4],[27,1,27,4],[28,1,28,4],[15,2,15,3],[6,1,6,4],[7,2,7,3],[8,1,8,4],[9,1,9,2],[9,3,9,4],[10,1,10,2],[10,3,10,4],[11,1,11,2],[11,3,11,4],[12,1,12,2],[12,3,12,4],[14,1,14,4],[1,1,1,4],[2,1,2,4],[3,1,4,1],[3,2,4,2],[3,3,4,3],[3,4,4,4]]}
[]
[null,"Risk Assessment "]
[null,"This worksheet can be used to assess a single risk at a divisional, operational or specific project level, which should be included in your risk register."]
[null,"Risk Description    \nProvide a brief description of the risk","Objective(s) affected\nBriefly list the objectives impacted by the risk","Risk Owner\nInclude name of the person managing the risk and the area of the agency they work in","Stakeholders consulted\nInclude internal and external stakeholders"]
[]
[]
[null,"Worst Case\nMake an assessment of the risk based on the scenario where the current controls do not exist or completely fail. \nRefer template for risk ratings legend"]
[null,"Consequence Level\nUse your consequence table","Likelihood Level\nUse your likelihood table",null,"Risk Level\nUse your risk matrix"]
[null,"Controls\nList each current control and its effectiveness (Excellent, Adequate, Inadequate)."]
[null,"Control (s) description ",null,"Control Effectiveness rating (s) "]
[null,"1.      ",null,"1.      "]
[null,"2.      ",null,"2.      "]
[null,"3.      ",null,"3.      "]
[]
[null,"Current Risk\n\nMake an assessment of the risk considering the effectiveness of current controls"]
[null,"Consequence Level\n","Likelihood Level\n",null,"Risk Level\n"]
[]
[null,"Treatment\n\nList additional controls to be put in place if the  risk is not acceptable/tolerable including resources required for each (financial, physical assets, HR) and schedule for implementation."]
[null,"Treatment","Resources Required","Person Responsible","Implementation Schedule"]
[null,"1.      ","1.      ",1,1]
[null,"2.      ","2.      ",2,2]
[null,"3.      ","3.      ",3,3]
[]
[null,"Residual Risk\n\nMake an assessment of the risk level remaining after risk treatment"]
[null,"Consequence Level\n","Likelihood Level\n",null,"Risk Level\n"]
[]
[null,"Monitoring and Review\n\nOutline the reporting protocols for the risk and when is the risk and controls are to be reviewed."]
[null,"Communicate and Consult\n\nDo you need to communicate the results of this risk assessment to any stakeholders? If so, what channel (s) will you use and what is the schedule?"]
[null,"Comments\n\nComment on any uncertainties or sensitivities - Are the risks that you have identified making the achievement of your agency’s objectives too uncertain?"]
[null,"Compiled by:","Branch / Division:","Date: DD/MM/YYYY","Reviewed by / date"]

{"sheet":"Risk Summary Report","index":4,"n_rows":26,"n_cols":9,"rows_kept":26,"cut":false,"hidden":false,"merged":[[17,7,17,9],[20,7,20,9],[21,7,21,9],[24,7,24,9],[25,7,25,9],[16,7,16,9],[1,1,1,9],[3,1,3,9],[5,1,5,9],[6,1,6,9],[7,1,7,9],[8,1,8,9],[9,4,9,5],[9,7,9,9],[11,8,11,9],[12,8,12,9],[13,8,13,9]]}
[]
[null,"Risk report"]
[]
[null,"You can design your own reporting templates, similar to this example, for summarising risk register information to present to key stakeholders."]
[]
[null,"Summary"]
[null,"Key comments:\nProvide an overall summary of the major risks facing the organisation, including treatments."]
[null,"Date submitted: DD/MM/YYYY"]
[null,"Report prepared by:"]
[null,null,"No major risks",null,"Major risks but treatment in place",null,null,"Major risks – ineffective or no treatments"]
[]
[null,"Risk profile","Risk 1","Risk 2","Risk 3","Risk 4","Risk 5","Risk 6","Risk 7"]
[null,"This report"]
[null,"Last report"]
[]
[null,"Risk 1"]
[null,"Risk \ndescription","Objective(s) affected","Current risk rating","Control effectiveness","Treatment","Risk owner","Trend of risk"]
[null,"Loss of Confidentiality",null,"Determine using your risk matrix.","Refer to Template 5b for the control effectiveness legend.","Description schedule\nResources required","Include the name of the person managing the risk and the area of the organisation he or she works in.","5 1 6"]
[]
[null,"Risk 2"]
[null,"Risk \ndescription","Objective(s) affected","Current risk rating","Control effectiveness","Treatment","Risk owner","Trend of risk"]
[null,"Loss of Integrity",null,"Determine using your risk matrix.","Refer to Template 5b for the control effectiveness legend.","Description schedule\nResources required","Include the name of the person managing the risk and the area of the organisation he or she works in.","5 1 6"]
[]
[null,"Risk 3"]
[null,"Risk \ndescription","Objective(s) affected","Current risk rating","Control effectiveness","Treatment","Risk owner","Trend of risk"]
[null,"Loss of Availability",null,"Determine using your risk matrix.","Refer to Template 5b for the control effectiveness legend.","Description schedule\nResources required","Include the name of the person managing the risk and the area of the organisation he or she works in.","5 1 6"]