Risk Strategy

The risk management strategy reflects the organization’s view of how it intends to manage risk—potentially of all types but at least within a discrete category of risk—including policies, procedures, and standards to be used to identify, assess, respond to, monitor, and govern risk. The strategy specifies strategic planning assumptions, constraints, decision-making criteria, and other factors influencing risk management in the organization, including context-specific and overall articulations of organizational risk tolerance. Risk management strategy identifies senior leaders and other stakeholders with significant decision-making authority and, in the context of describing risk governance, should clearly describe the information flows and decision-making processes related to risk management. Following NIST guidance to agencies in Special Publication 800-39, comprehensive organizational strategies for managing the risk associated with agency information systems include clear expression of risk tolerance, preferred or endorsed methodologies for risk assessment, primary risk response alternatives, descriptions of risk-based decision criteria and decision-making processes, and organizational approaches for monitoring risk [27]. The development and implementation of the organizational risk strategy is assumed in NIST guidance to be the responsibility of the risk executive (whether that role corresponds to an individual, a group, or an organizational function).