Business Risk
What is Business Risk?
The potential for events or conditions to adversely affect an organization's ability to achieve its business objectives and maintain operations.
Terms that appear alongside business risk
Each of these is named in at least one of the same controls as business risk. The number is how many controls name both.
- compliance 3 shared controls
- risk assessment 3 shared controls
- information security 3 shared controls
- data protection 2 shared controls
- due diligence 2 shared controls
- remediation 2 shared controls
- gap analysis 2 shared controls
- grc 2 shared controls
Frameworks that govern business risk
What the standards actually require on business risk
Requirements naming business risk across 6 standards, quoted from the control text.
An FMI has robust systems to identify, monitor and manage general business risk such as poor strategy execution, negative cash flows and unexpectedly large operating costs.
cpmi-iosco-principles-for-financial-market-infrastructures::P15 · Principle 15 General business risk →The report includes an executive summary for those responsible for oversight and strategy and for those the findings affect: the background and purpose of the test tied to the pre-engagement goals (with any objective change and its letter of amendment referenc...
ptes::PTES-5.1 · Require an executive summary that ties findings to business risk →Business process activities and their related controls are assessed and monitored continually according to enterprise risk so that processing controls match what the business needs: the control activities that key processes require to meet control requirements...
cobit-2019::DSS06.01 · DSS06.01 Align control activities embedded in business processes with enterprise objectives →Business units receive cybersecurity training relevant to their own business risks.
ffiec-cybersecurity-assessment-tool-cat::D1.TC.Tr.E.4 · D1.TC.Tr.E.4 Training (Evolving 4) →Intermediate control principles for threat intelligence sharing (required, with baseline, of an AI whose inherent risk is medium). Management gives business units threat intelligence with business risk context and specific recommendations;
hkma-cyber-resilience-assessment-framework-c-raf::6.2.I · 6.2 Threat intelligence sharing: intermediate level →Decide whether to go ahead with the strategy proposed and its implications, or to consider continuing an existing arrangement, on the facts gathered and those in the business case, with both qualitative and quantitative arguments;
iso-37500-2014::6.7 · Evaluate and decide →Questions people ask about business risk
What is Business Risk?
Why is Business Risk important for compliance?
Which compliance frameworks address Business Risk?
Where can I learn more about Business Risk?
See how Business Risk applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.