8 min read

Section 11

Risk Treatment & Executive Communication

Identifying and quantifying risk is half the job — the other half is deciding what to do about it and communicating it effectively. This section covers the four treatment strategies, risk appetite operationalization, risk register management, executive reporting, and risk exception governance.

Risk Treatment Strategies

Risk Treatment Decision Framework

Mitigate (Reduce)

Implement controls to reduce likelihood and/or impact. Most common treatment strategy.

When to use:
  • • Effective controls exist at reasonable cost
  • • Risk-to-mitigation cost ratio is favorable
  • • Regulatory requirement mandates specific controls
Decision data needed:
  • • Control implementation cost
  • • Expected risk reduction (pre/post FAIR analysis)
  • • Ongoing operational cost

Accept

Acknowledge the risk and proceed without additional controls. Requires formal documentation.

When to use:
  • • Risk falls within defined risk appetite
  • • Cost of mitigation exceeds potential loss
  • • Temporary acceptance with compensating controls
Requirements:
  • • Signed risk acceptance by appropriate authority
  • • Defined review period (typically 6-12 months)
  • • Compensating controls documented

Transfer

Shift the financial impact to a third party through insurance or contractual transfer.

When to use:
  • • Low-frequency, high-impact risks
  • • Cyber insurance is cost-effective
  • • Contractual indemnification available
Caution:
  • • Transfers financial risk, not reputational risk
  • • Insurance exclusions (acts of war, ransomware)
  • • Regulatory obligations can't be transferred

Avoid

Eliminate the risk by removing the activity, system, or process that creates it.

When to use:
  • • Risk exceeds organizational risk tolerance
  • • No cost-effective mitigation exists
  • • Business case doesn't justify the risk
Examples:
  • • Decommissioning a legacy system
  • • Not entering a high-risk market
  • • Discontinuing a feature with unmanageable risk

Risk Appetite & Tolerance

Appetite vs Tolerance vs Capacity

Risk appetite: The amount of risk the organization is willing to take to achieve its objectives (strategic). Risk tolerance: The specific thresholds for acceptable variation (operational). Risk capacity: The maximum risk the organization can absorb before viability is threatened (financial).
risk-appetite-framework.txt 
Risk Appetite Statement Framework
══════════════════════════════════

STRATEGIC RISK APPETITE (Board-level)
─────────────────────────────────────
"[Organization] accepts a MODERATE level of cybersecurity risk 
in pursuit of digital transformation objectives. We will NOT 
accept risks that could result in:
  • Loss of customer PII affecting >10,000 records
  • Regulatory fines exceeding $5M
  • Business interruption >24 hours for critical services
  • Reputational damage from data breach making national news"

OPERATIONAL RISK TOLERANCE (CISO-level)
───────────────────────────────────────
Category              Tolerance          Escalation
─────────────────────────────────────────────────────
Critical vulns        0 unpatched >72h   → CISO immediate
High vulns            0 unpatched >30d   → Security Lead
Vendor risk (Tier 1)  Score ≥ 70/100     → Risk Committee
Open risk acceptances Max 20 concurrent  → CISO quarterly
ALE per risk          < $2M annually     → Auto-accept
ALE per risk          $2M-$10M           → Risk Committee
ALE per risk          > $10M             → Board/CEO

RISK CAPACITY (CFO-level)
─────────────────────────
• Cyber insurance coverage: $50M per occurrence
• Self-insured retention: $2M
• Maximum acceptable annual cyber loss: $25M
• Cash reserves for incident response: $5M

Risk Register

The risk register is the living document that captures all identified risks, their scores, treatment decisions, and status. It's the primary output of significant TRA engagement.

ID Risk ALE (FAIR) Treatment Control Owner Status
R-001 Cardholder data breach via API exploitation $3.2M–$8.5M Mitigate WAF + API gateway + runtime protection Platform Lead In Progress
R-002 Ransomware via compromised CI/CD pipeline $1.8M–$4.2M Mitigate SLSA Level 3 + signed artifacts + RBAC DevOps Lead Complete
R-003 Single cloud region failure (us-east-1) $800K–$2.1M Accept Multi-AZ (not multi-region) — cost accepted CTO Accepted
R-004 Regulatory fine from GDPR data subject request failure $500K–$3M Transfer Cyber insurance + automated DSR workflow DPO Complete

Executive Reporting

Executives don't need threat details — they need decision-ready summaries. Structure TRA reports for your audience level.

Board / C-Suite

  • • 1-page executive summary
  • • Top 5 risks with ALE ranges
  • • Risk trend (improving/worsening)
  • • Investment ask with ROI
  • • Peer benchmarking data
  • • Format: dashboard with traffic lights

Risk Committee / CISO

  • • Full risk register with FAIR scores
  • • Treatment plan and timeline
  • • Control effectiveness assessment
  • • Risk acceptance decisions needed
  • • Exceptions and waivers status
  • • Format: detailed report + risk matrix

Technical / Engineering

  • • Detailed threat scenarios
  • • Attack trees and DFDs
  • • Specific control recommendations
  • • Remediation backlog items
  • • Architecture diagrams with risk annotations
  • • Format: technical appendix + JIRA items

Risk Exceptions & Waivers

risk-exception-process.txt 
Risk Exception / Waiver Governance Process
═══════════════════════════════════════════

WHEN TO REQUEST AN EXCEPTION
─────────────────────────────
• A mandated control cannot be implemented by deadline
• Cost of full compliance exceeds risk-justified spending
• Technical debt requires phased remediation
• Legacy system cannot support required controls

EXCEPTION REQUEST TEMPLATE
───────────────────────────
Risk ID:          [R-XXX]
Requested by:     [Name, Title]
Risk description: [What risk is being accepted]
Current ALE:      [$ range from FAIR analysis]

Why exception needed:
  [Business/technical justification]

Compensating controls in place:
  1. [Control description and effectiveness]
  2. [Control description and effectiveness]

Residual risk with compensating controls:
  [Updated ALE estimate]

Requested duration: [X months, max 12]
Review date:        [Specific date]

APPROVAL AUTHORITY
──────────────────
ALE < $500K:   Security Lead
ALE $500K-$2M: CISO
ALE $2M-$10M:  Risk Committee
ALE > $10M:    CEO / Board

GOVERNANCE REQUIREMENTS
───────────────────────
• All exceptions tracked in risk register
• Maximum exception duration: 12 months
• Mandatory review at expiration
• Auto-escalation if not renewed or remediated
• Quarterly exception summary to Risk Committee

GRC Tool Integration

Platform Strengths Best For API
ServiceNow IRM Enterprise integration, workflow automation Large enterprises with ITSM integration REST API, IntegrationHub
Archer (RSA) Customizable data model, reporting Regulated industries, complex frameworks REST API
LogicGate Risk Cloud Modern UI, no-code workflows, FAIR support Mid-market, teams wanting FAIR quantification REST API, webhooks
OneTrust Privacy + security risk, vendor management Privacy-focused orgs, GDPR compliance REST API, pre-built integrations

Section Summary

Key Takeaways

  • • Four treatment strategies: mitigate, accept, transfer, avoid
  • • Risk appetite must be formally defined at strategic, operational, and financial levels
  • • Risk registers are living documents with clear ownership and review cycles
  • • Tailor reporting depth to audience: board, risk committee, engineering
  • • Risk exceptions require formal governance with time-boxing and approval authority

Evidence to Capture

The artefact is the decision: who accepted what, on what basis, until when. A register without those fields is a list, not a treatment record.

Treatment decision and owner: The strategy per risk, the named owner, the due date and the acceptance criterion that will close the action.

Residual risk: The post-treatment likelihood and impact, the method used to arrive at them, and the date they were set.

Acceptance authority: Who accepted the residual, their role and the delegated authority behind it. Acceptance belongs with the risk owner, not the assessor.

Exception record: For a time-boxed exception: justification, compensating control, expiry date and the approval trail.

Cost against benefit: Control cost measured against the risk reduction, so the decision can be revisited when either side of the ratio moves.

Reporting basis: For executive output: the currency or scale used, the reporting period, and the appetite statement the positions are measured against.

Treatment and Reporting False Positives

A tidy dashboard is not a treated risk, and an acceptance signature is not an analysis.

  • Accepted without authority: An owner marking their own risk accepted is not acceptance unless the delegation gives them that decision.
  • Residual not recomputed: Copying the pre-treatment rating into the residual column after a control ships claims a benefit nobody measured.
  • Control gap in the risk column: A missing control belongs in the treatment plan of the risk it affects, not as a standalone risk entry.
  • Exception without an expiry: An open-ended exception is acceptance without review, and it will outlive the compensating control it depended on.
  • Portfolio average hiding the tail: A mean risk position across a portfolio conceals the one risk above appetite that needs a decision this quarter.
  • Summary without the register: A one-page board deck with no register behind it cannot be audited, and cannot be re-based next quarter.

Execute the Plan, Reopen at the Trigger

Treatment plus the review point: execute the plan, recompute the residual, and expire exceptions automatically rather than remembering them.

Execute and track

  • • One owner, due date and acceptance criterion per action
  • • Recompute residual risk after the control is verified, not after it is scheduled
  • • Report variance against the plan to the risk committee

Govern the exceptions

  • • Time-box every exception and expire it automatically
  • • Require a named approver and a compensating control
  • • Summarise the open exception population at each review

Review trigger

  • • Exception expiry, or the compensating control fails
  • • Appetite or tolerance restated by the board
  • • Reassessment date reached, or a realised loss that changes the estimate