{"id":105,"date":"2020-02-08T10:06:18","date_gmt":"2020-02-08T10:06:18","guid":{"rendered":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/?post_type=chapter&p=105"},"modified":"2020-04-23T08:08:28","modified_gmt":"2020-04-23T08:08:28","slug":"framework-nuts-and-bolts","status":"publish","type":"chapter","link":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/chapter\/framework-nuts-and-bolts\/","title":{"raw":"Frameworks: the nuts and bolts","rendered":"Frameworks: the nuts and bolts"},"content":{"raw":"

Tools (1) - Spreadsheets<\/h1>\r\nSpreadsheets are useful tools for basic risk assessments and the most common. Excel and similar spreadsheet programs are widely accessible making these easy to complete and share. If a spreadsheet is set up correctly, it will provide a quick and easy way to manage, assess and grade risks for a simple situation.\r\n\r\nIf we use one of the\u00a0basic risk methodologies we discussed above\r\n
risk = threat x vulnerability x impact<\/pre>\r\nwe end up with something like this.\r\n\r\n\"\"\r\n\r\nAgain, more complicated formulas can be tackled in a spreadsheet. The more complicated the formula, the more care that needs to be taken to ensure that all of the links and formatting are set up correctly.\r\n\r\nOne additional tip is to lock down as much of the spreadsheet as possible. This should allow you to set criteria so only the permissible values (e.g. 1 - 3) can be added and lock cells so only the description and value can be added. Otherwise you will find that people accidentally change the formulas and formatting which is a disaster.\r\n
\u00a0Tools (2) - The Boston Square<\/h1>\r\nThe Boston Square is another popular tool for risk assessments and can be used as a stand-alone tool or a way to represent risk results. The Boston Square presents information with two values on a color-coded grid.\u00a0This works well if you are using the basic\u00a0likelihood x impact formula: you simply allocate an axis to each factor and plot risks on the grid accordingly.\r\n\r\nThis example shows the\u00a0overall risk value for each quadrant:\r\n\r\n\"\"\r\n\r\nThis\u00a0example plots the infrastructure risk as described in the likelihood\u00a0x impact spreadsheet above:\r\n\r\n\"\"\r\n\r\nThe Boston Square\u00a0is often used as a simple way to brainstorm risks in a workshop. Note\u00a0that this approach allows a lot of bias and subjectivity into the assessment, rather than evaluating each risk on its own factors, so there is a tendency to immediately start to compare risks to one another.\r\n\r\nAlthough I would\u00a0recommend that you use a different tool for assessing your risks, the Boston Square can still\u00a0be used as a way to represent the findings of your assessment. You can\u00a0begin by assessing the risks in a spreadsheet before transferring the final results to an appropriately marked Boston Square. This provides a simple way to represent your findings while maintaining\u00a0the objectivity of the assessment process.\r\n
More Detail = More Refinement<\/h1>\r\nThe r = tvi<\/em> <\/strong>formula that I prefer (more on that in the next part) uses a similar metrics structure but has five different values and ratings to allow some additional refinement in the results. The metrics are shown below and I have also included a short description of what each term could mean when used to describe a different factor.\r\n\r\n \r\n\r\n\"\"\r\n\r\nThese definitions are not fixed and this is something that can be adapted for your organization or the particular assessment.\r\n\r\nAlthough this is a little\u00a0busier than the previous example, the underlying concept is the\u00a0same. A value, color or term can be applied to each factor.\r\n\r\nWe can't use a\u00a0Boston Square here as that\u00a0limits us to two factors but we can use other\u00a0graphs and charting tools to represent our results, as required.\r\n\r\nAn example of one comparison graph is shown below. It illustrates how overall risk can be compared to the likely impact of an event.\u00a0This helps highlight higher impact events irrespective of their overall\u00a0risk as these can be particularly damaging\u00a0to an organization.\r\n\r\n\"\"\r\n\r\nFor example, in\u00a0this case, although safety and infrastructure threats pose similar risks and would\u00a0both\u00a0fall into the\u00a0'significant' category, infrastructure risks carry potentially higher impacts which might prioritize this as an area\u00a0for action.\r\n\r\nNone of these examples are provided to give you the 'perfect' way to present your data. Don't forget, the approach you take will depend on your client. However, it's worth being aware of some of the different ways you can present your information and results as this will give you additional flexibility when you're planning your own assessment.\r\n
Summary<\/h1>\r\nThere are many systems and methodologies\u00a0for risk assessment. Most\u00a0involve a set of metrics\u00a0with some combination of descriptive terms, quantitative values and a color-code.\u00a0Personally, I now use the r=tvi model and the DCDR.io assessment tool I built for assessments. I save the Boston Square for more subjective brainstorming\u00a0to compare options.\r\n\r\nHowever, whichever approach you use, the options outlined above offer some basic frameworks that can then be built on for more complicated systems that you can adapt for your own assessments in the future. The key thing to ensure is that you have a clear and robust system of grading and metrics in place before you start.\r\n\r\n ","rendered":"
Tools (1) – Spreadsheets<\/h1>\n
Spreadsheets are useful tools for basic risk assessments and the most common. Excel and similar spreadsheet programs are widely accessible making these easy to complete and share. If a spreadsheet is set up correctly, it will provide a quick and easy way to manage, assess and grade risks for a simple situation.<\/p>\n
If we use one of the\u00a0basic risk methodologies we discussed above<\/p>\n
risk = threat x vulnerability x impact<\/pre>\n
we end up with something like this.<\/p>\n
\"\"<\/p>\n
Again, more complicated formulas can be tackled in a spreadsheet. The more complicated the formula, the more care that needs to be taken to ensure that all of the links and formatting are set up correctly.<\/p>\n
One additional tip is to lock down as much of the spreadsheet as possible. This should allow you to set criteria so only the permissible values (e.g. 1 – 3) can be added and lock cells so only the description and value can be added. Otherwise you will find that people accidentally change the formulas and formatting which is a disaster.<\/p>\n
\u00a0Tools (2) – The Boston Square<\/h1>\n
The Boston Square is another popular tool for risk assessments and can be used as a stand-alone tool or a way to represent risk results. The Boston Square presents information with two values on a color-coded grid.\u00a0This works well if you are using the basic\u00a0likelihood x impact formula: you simply allocate an axis to each factor and plot risks on the grid accordingly.<\/p>\n
This example shows the\u00a0overall risk value for each quadrant:<\/p>\n
\"\"<\/p>\n
This\u00a0example plots the infrastructure risk as described in the likelihood\u00a0x impact spreadsheet above:<\/p>\n
\"\"<\/p>\n
The Boston Square\u00a0is often used as a simple way to brainstorm risks in a workshop. Note\u00a0that this approach allows a lot of bias and subjectivity into the assessment, rather than evaluating each risk on its own factors, so there is a tendency to immediately start to compare risks to one another.<\/p>\n
Although I would\u00a0recommend that you use a different tool for assessing your risks, the Boston Square can still\u00a0be used as a way to represent the findings of your assessment. You can\u00a0begin by assessing the risks in a spreadsheet before transferring the final results to an appropriately marked Boston Square. This provides a simple way to represent your findings while maintaining\u00a0the objectivity of the assessment process.<\/p>\n
More Detail = More Refinement<\/h1>\n
The r = tvi<\/em> <\/strong>formula that I prefer (more on that in the next part) uses a similar metrics structure but has five different values and ratings to allow some additional refinement in the results. The metrics are shown below and I have also included a short description of what each term could mean when used to describe a different factor.<\/p>\n
 <\/p>\n
\"\"<\/p>\n
These definitions are not fixed and this is something that can be adapted for your organization or the particular assessment.<\/p>\n
Although this is a little\u00a0busier than the previous example, the underlying concept is the\u00a0same. A value, color or term can be applied to each factor.<\/p>\n
We can’t use a\u00a0Boston Square here as that\u00a0limits us to two factors but we can use other\u00a0graphs and charting tools to represent our results, as required.<\/p>\n
An example of one comparison graph is shown below. It illustrates how overall risk can be compared to the likely impact of an event.\u00a0This helps highlight higher impact events irrespective of their overall\u00a0risk as these can be particularly damaging\u00a0to an organization.<\/p>\n
\"\"<\/p>\n
For example, in\u00a0this case, although safety and infrastructure threats pose similar risks and would\u00a0both\u00a0fall into the\u00a0‘significant’ category, infrastructure risks carry potentially higher impacts which might prioritize this as an area\u00a0for action.<\/p>\n
None of these examples are provided to give you the ‘perfect’ way to present your data. Don’t forget, the approach you take will depend on your client. However, it’s worth being aware of some of the different ways you can present your information and results as this will give you additional flexibility when you’re planning your own assessment.<\/p>\n
Summary<\/h1>\n
There are many systems and methodologies\u00a0for risk assessment. Most\u00a0involve a set of metrics\u00a0with some combination of descriptive terms, quantitative values and a color-code.\u00a0Personally, I now use the r=tvi model and the DCDR.io assessment tool I built for assessments. I save the Boston Square for more subjective brainstorming\u00a0to compare options.<\/p>\n
However, whichever approach you use, the options outlined above offer some basic frameworks that can then be built on for more complicated systems that you can adapt for your own assessments in the future. The key thing to ensure is that you have a clear and robust system of grading and metrics in place before you start.<\/p>\n
 <\/p>\n","protected":false},"author":253,"menu_order":8,"template":"","meta":{"pb_show_title":"on","pb_short_title":"","pb_subtitle":"","pb_authors":[],"pb_section_license":""},"chapter-type":[48],"contributor":[],"license":[],"class_list":["post-105","chapter","type-chapter","status-publish","hentry","chapter-type-numberless"],"part":172,"_links":{"self":[{"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/pressbooks\/v2\/chapters\/105","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/pressbooks\/v2\/chapters"}],"about":[{"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/wp\/v2\/types\/chapter"}],"author":[{"embeddable":true,"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/wp\/v2\/users\/253"}],"version-history":[{"count":10,"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/pressbooks\/v2\/chapters\/105\/revisions"}],"predecessor-version":[{"id":318,"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/pressbooks\/v2\/chapters\/105\/revisions\/318"}],"part":[{"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/pressbooks\/v2\/parts\/172"}],"metadata":[{"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/pressbooks\/v2\/chapters\/105\/metadata\/"}],"wp:attachment":[{"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/wp\/v2\/media?parent=105"}],"wp:term":[{"taxonomy":"chapter-type","embeddable":true,"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/pressbooks\/v2\/chapter-type?post=105"},{"taxonomy":"contributor","embeddable":true,"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/wp\/v2\/contributor?post=105"},{"taxonomy":"license","embeddable":true,"href":"https:\/\/authorlab.pro\/layout\/beyondthespreadsheet\/wp-json\/wp\/v2\/license?post=105"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}