Risk Map and Risk Overview

Under the risk list on the Risks tab of an assessment, the Risk map shows where the assessment's risks sit before and after the corrective measures. The Risk overview draws how the risk sources, threats, feared events, impacts and measures connect. Both support the DPIA validation work.

The Risk Map

The map shows two grids: the risks Before the corrective measures and After the corrective measures. Each risk is placed by its severity and likelihood, and each cell is coloured by its level and counts its risks.

• Keyboard. Tab moves to one cell per grid. The arrow keys move between cells, Home and End move along a row, and Enter lists the cell's risks.
• The table. Below the grids, a table with Risk, Before, After and Change columns says the same in words.
• Not on the map. Risks without a level yet are listed as Not on the map. Closed risks are left out.

The Risk Overview

Risk overview draws the risk sources, threats, feared events, impacts and measures of the assessment and how they connect. It is drawn from the risks as they are now: their sources, threats, impacts, mitigation measures and linked controls.

Save as working document keeps a copy in the assessment's working files, and Open in Documents opens it there.

Rating on the Questionnaire's Own Scale

Where the questionnaire defines its own risk matrix, the risk panel rates on that scale and shows each level's definition beside it.

• The France CNIL questionnaire rates severity and likelihood from Negligible to Maximum.
• The universal PIA questionnaire (ISO/IEC 29134) has its own four-level matrix: likelihood and impact are each Negligible, Limited, Significant or Maximum, the same levels its risk table offers, and every pair gives Low, Medium, High or Very high. Ratings entered in its risk table produce a level before and after treatment.

Standard Risks

Some questionnaires create standard risks on every new assessment, marked Standard risk. The CNIL's three feared events are standard risks in France, and so are the five privacy risks the OIPC requires every Alberta HIA PIA to address. A required standard risk cannot be removed from its table. Rate it, describe its circumstances and mitigation, or explain why it does not apply (in the CNIL method, rate it Negligible).

Risk Maps in the PDFs

The two maps print as tables: severity down the side with the most severe first, likelihood along the top, each cell showing its level and the numbers (or the short labels of standard risks) of the risks placed in it. They are followed by the Risk, Before, After, Change table.

They always print in the CNIL report. In the assessment PDF and every other summary layout (the audit report aside) they print right after the risk table when the questionnaire's risk matrix asks for a printed map. The France CNIL and universal PIA questionnaires do.

Related Pages

• DPIA Validation — the Validation tab and the CNIL PIA report.
• Assessment Details — the assessment panel and its tabs.
• Risk Categories — the shared risk register categories.