Two Scales, One Register: Acceptance Authority at Northgate Hospital
Northgate Regional Hospital (620 beds, 4,100 staff) runs an ISO/IEC 27001-conformant ISMS. Its risk register uses a 5×5 likelihood-impact matrix, but the radiology department has applied a 1–3 scale inherited from a clinical safety programme, and finance scores 'impact' as direct financial loss only. The CISO must present a consolidated view to the audit committee in three weeks. Two entries show the problem: unauthorised access to the PACS image archive is scored 4×4 by IT and 2×2 by radiology; a ransomware entry affecting admission systems is scored 3×5 by IT but was relabelled 'acceptable' by the clinical director because 'patient care would continue manually'. The CIO has already signed a statement that residual risk is within appetite. The internal auditor has challenged whether the register can support that statement and whether the clinical director had authority to accept the ransomware risk.
1. What has gone wrong with Northgate's risk criteria and risk evaluation, and what must be in place before the audit committee can rely on the register?
Read the worked answer
The register cannot support the CIO's statement, for three reasons that map to the criteria and evaluation steps of the ISO/IEC 27005 process.
1. Risk criteria were never made operational. ISO/IEC 27005 expects risk criteria to be established during context establishment, before assessment: defined impact levels, defined likelihood levels, rules for combining them, and risk acceptance criteria including thresholds and who may accept. Northgate has at least three incompatible conventions - 5×5 in IT, 1–3 in radiology, financial-only impact in finance - so 4×4, 2×2 and 3×5 are not on a common scale and cannot be compared, ranked or aggregated. Rescaling the 1–3 scores arithmetically would be arbitrary, because the radiology scale was built for clinical safety, where 'moderate' means something different.
2. Impact has been narrowed incorrectly. Information security impact is not only direct financial loss. For a hospital it must also capture patient safety, clinical continuity, legal and regulatory exposure, privacy of patient records and reputation. Finance's definition systematically understates both the PACS and the admission-system entries.
3. Acceptance was not an authorised decision. Risk acceptance is a decision by the risk owner - the person accountable for the risk with authority to commit resources - recorded with justification, compensating controls, an expiry or review date, and reference to pre-defined criteria. A clinical director may own a clinical process risk but cannot unilaterally declare a 3×5 enterprise ransomware risk acceptable by asserting manual fallback, without testing whether manual operation meets a defined maximum tolerable downtime.
The auditor's challenge is therefore well founded: evaluation has produced no evidence that residual risk is within appetite.
2. You have three weeks before the audit committee. Set out what the CISO should do, and what should and should not be claimed in the committee paper.
Read the worked answer
Three weeks is enough to make the register defensible, but not to re-assess 240 entries. Sequence it as follows.
Week 1 - freeze and calibrate. Stop silent re-scoring; keep an audit trail showing the old score, the new score and the reason for every change. Convene a calibration workshop with IT, radiology, finance and clinical leadership, and agree one 5×5 matrix with written level definitions covering clinical, regulatory, financial, privacy and reputational impact (for example, 'major = admission system unavailable more than 4 hours or more than 200 patients affected').
Week 2 - re-evaluate the top slice only. Re-score the risks that feed the CIO's statement, typically the top 20, on the agreed scale, with evidence and a confidence note where data is weak. Express results as ranges where uncertainty is real rather than forcing false precision. Name a risk owner for each.
Week 3 - decide authority and report honestly. Get executive approval of an acceptance authority matrix - for example, scores of 15 or more to the executive risk committee, 20 or more to the board, and nothing above 12 accepted at departmental level. Have the CIO reissue or withdraw the appetite statement so it matches the re-evaluated register.
The committee paper should claim: a single scale, named owners, a defined acceptance authority, and a dated remediation plan. It should not claim enterprise-wide coverage, comparability with last year's numbers, or that residual risk is within appetite across all domains. Present the gaps and the plan to close them - an auditor accepts a documented, owned gap far more readily than an unsupported assurance statement.