# 23 Risk management policy

| | |
| --- | --- |
| Version | 0.1 draft |
| Owner | Security Owner |
| Review | Yearly |
| Applies to | The in-scope system and the company processes that support it |

## Risk assessment

1. A risk assessment runs at least yearly and whenever there is a significant change: a new product in scope, a new vendor of High tier, a new region, a new data class, an infrastructure move, or a severity 1 incident (RSK-01, RSK-03).
2. It considers threats (external attack, insider misuse, vendor failure, error, natural events, fraud), vulnerabilities (from scans, pentests, incidents, the gap assessment), and the commitments in [06 System description](/soc2/06-system-description).
3. **Fraud risk** is assessed explicitly (CC3.3): misuse of payment and invoicing functions, manipulated access reviews, falsified evidence, and misuse of customer data by personnel.
4. Each risk is scored for likelihood (1 to 5) and impact (1 to 5). Score = likelihood times impact.

## Treatment

| Score | Treatment required |
| --- | --- |
| 15 to 25 | Mitigate before the next audit period starts, or a director signs an acceptance |
| 8 to 14 | Owner and plan within 90 days |
| 1 to 7 | Accept and monitor |

Each risk has an owner, a treatment (mitigate, transfer, accept, avoid), linked controls, and a target date (RSK-02). Accepted risks are signed by a director with a review date no more than 12 months away.

## Register

The register is kept in the source repository at `soc2-internal/risk-register.md` and is **not published**, because it describes weaknesses. It is shared with the auditor under NDA.

## Insurance

Cyber liability and technology errors and omissions insurance are evaluated yearly; the decision is recorded (RSK-04).