This guide describes the path of a risk in Varmo: reporting, reviewing and assessing, treatment by the risk owner and acceptance of the residual risk, with approval by management where required. It is aimed at everyone who reports, reviews or is responsible for risks.

Before you start

  • As a rule, anyone may report risks. The standard role “Employees” includes this permission. Without further permissions, you only see My reports under Risks.
  • The ISMS managers define who reviews and assesses reports under ISMS settings › Risks › Reporting & treatment: either a Reviewer role or everyone with the permission to assess risks. Required fields, urgency, source and whether anonymous reports are allowed are also set there.
  • The rating follows the active risk methodology, and acceptance follows the risk acceptance criteria. Both are explained in Defining the risk methodology and acceptance criteria; the acceptance criteria are on the same settings page, Reporting & treatment.
  • If something is happening right now, report a security incident instead of a risk. The form points this out at the top.
  1. Reporting personReport

    What did you notice, where and since when?

  2. ReviewerReview and assess

    Likelihood, impact, treatment option, measures and risk owner.

  3. Risk ownerApprove treatment plan

    Decides who implements each measure.

  4. People responsibleImplement measures

    Until approval, the measures remain “Planned”.

  5. ReviewerAssess residual risk

    Never someone responsible for one of the measures.

  6. Risk ownerAccept residual risk

    If the risk owner declines with a justification, further measures are needed.

Approval by management

If the risk acceptance criteria require it for this level, the defined functional role, by default top management, also approves.

“Accept” option

Without measures: acceptance by the risk owner is due immediately.

The path of a risk

Six steps: the reporting person reports the risk. The reviewer reviews and assesses it and plans the treatment. The risk owner approves the treatment plan. The people responsible implement the measures. The reviewer assesses the residual risk. The risk owner accepts the residual risk. If the risk acceptance criteria require it, the defined functional role, by default top management, also approves the acceptance.

How to report a risk

  1. Open Risks and click Report risk. Alternatively, open the Risks tab on the asset page, where the asset is pre-filled.
  2. Briefly and specifically describe what you noticed, where and since when. Choose the affected asset or Don't know, plus source and urgency, depending on the settings.
  3. Click Submit report. If allowed, you can also report without your name with Report anonymously.

Anyone who may assess risks themselves can use New risk to record an assessed risk directly in three steps (What and where, Assessment, Treatment and review).

How to review and assess a report

The reviewer receives the task Review and assess risk report.

  1. Complete the title, asset, threat (several are possible) and description.
  2. Rate the likelihood and impact; with damage categories, per category. The risk level follows from the matrix.
  3. Choose the Treatment option: Reduce, Avoid, Share or Accept. Except for “Accept”, you define at least one measure, existing or new with title and due date. For “Reduce” and “Avoid”, the expected residual risk is also required. For “Accept”, you justify why the risk is retained.
  4. Assign to each measure the Requirements it implements (ISO/IEC 27001, 6.1.3 b). For “Reduce”, this is required as soon as your organisation uses requirement catalogues: if a measure has no requirement, the risk owner cannot approve the treatment plan, and the residual risk cannot be assessed.
  5. Choose the Risk owner. If another person becomes risk owner, a justification is required.
  6. Set the next review. Varmo suggests a date per risk level.
  7. Click Complete review. With Save as draft, you save an interim state without completing the review.

What happens next

  1. Approve treatment plan: the risk owner receives the task Accept responsibility and treatment plan. They approve the plan and decide who implements each measure. They can also request a change or decline responsibility, with a justification. Until approval, the measures remain “Planned”.
  2. Implement: the people responsible implement the measures. See Implementing and evidencing measures.
  3. Assess residual risk: once all measures have been implemented, the reviewer assesses the residual risk. Anyone responsible for one of the measures may not do so (four-eyes principle).
  4. Accept residual risk: the risk owner accepts the residual risk or declines it with a justification. Further measures are then needed. With the “Accept” option, this acceptance is due immediately.
  5. Approval by management: if the acceptance criteria require approval for this level, the chosen functional role, by default top management, receives the task Approve risk acceptance. It chooses Approve acceptance or declines with a justification. The risk owner never approves themselves.

Varmo automatically sends back a residual risk that is not acceptable. Risks › Treatment plan shows the status of all open risks.

Regular review

30 days before the date, the risk owner receives the task Review risk. If everything is unchanged, Varmo sets the next date. If something has changed, the risk owner describes it, and the risk goes back to the reviewer for reassessment. You close a risk that no longer exists with Close risk and a justification.

Frequently asked questions

Can I delete a report?

Only as long as it has never been assessed. You close assessed risks instead.

The risk owner has declined responsibility. What now?

The reviewer receives a task and designates a new risk owner.

What does “The treatment plan is still incomplete” mean?

For “Reduce”, at least one measure does not have the requirements it implements defined. The risk owner requests a change with a justification; the reviewer receives the task Define requirements for the treatment and adds the requirements to the measure. For “Share”, the same task appears if no measure has a requirement, but approval is not blocked there.

Why can't I choose “Accept”?

According to your organisation's acceptance criteria, the risk level is not acceptable. Choose another treatment option.