Case 5 - Three Registers, Three Scales, One Board Paper
Kestrel Logistics Group has a head office and three country units (Poland, Spain, Vietnam). Each unit runs its own risk register. Poland scores likelihood and impact on a 5×5 matrix; Spain uses a 3×3 matrix; Vietnam records only a monetary estimate of annual loss. The group risk committee wants a single top-ten list for the board and a decision on whether to fund a €1.5 million group-wide backup and recovery programme. The Polish register's highest entry is 'warehouse management system unavailable' scored 20 (5×4). Spain's highest is 'ransomware' scored 9 (3×3). Vietnam's highest is 'fuel theft' at €250,000 per year, which is not an information security risk at all. Each unit insists its top risk deserves group funding. The committee has one meeting before budget submission.
1. Why can the three registers not be merged by score or by rank?
Read the worked answer
Because the numbers do not measure the same thing. A 20 from a 5×5 matrix and a 9 from a 3×3 matrix are products of ordinal labels; the arithmetic is conventional, and the scale definitions differ, so ordering them compares incomparable units. Likelihood may be defined per year, per event or per asset, and impact may cover different dimensions - Poland may be scoring service interruption while Spain scores regulatory exposure.
Vietnam's €250,000 annual loss is a different construct again: an expected annualised figure rather than a matrix cell, and for a risk that may not be an information security risk at all.
Ranking across these registers yields an arbitrary top ten and could direct €1.5 million to the wrong place. The context establishment and risk criteria elements of ISO/IEC 27005 exist precisely to prevent this: scope, scales and criteria must be common before results can be aggregated or compared.
2. Propose a defensible way to produce a group top ten and to decide on the €1.5 million programme.
Read the worked answer
Define group risk criteria first: consequence dimensions with bands (financial in euros, regulatory, customer and service, safety), likelihood with a common time horizon and unit of exposure, and appetite and tolerance thresholds.
Then have each unit re-express its significant scenarios in that common form, with assumptions and owners, in a facilitated calibration. Re-score rather than translate the old numbers, and use ranges where data are thin. Aggregate at the appropriate level: a group-level risk may combine several unit risks - the same ransomware scenario across three warehouses - rather than being the maximum of them.
Evaluate the consolidated list against the criteria and note dependencies: one backup programme addresses availability risks in all units, which is an argument about treatment efficiency, not about rank. The group risk committee, advised by the CISO, evaluates and recommends; the accountable executive accepts residual risk within delegated authority. Record the method and the disagreements.
3. How should Vietnam's fuel-theft entry be handled?
Read the worked answer
Screen it against scope before any comparison. ISO/IEC 27005 addresses risk to information and to information security objectives - confidentiality, integrity and availability. Fuel theft is primarily a physical asset and business risk; it belongs in the enterprise risk register and should not be ranked alongside information security scenarios.
But check whether there is an information component: manipulation of fuel-card transactions, tampering with telemetry, or falsified consumption data would be an integrity risk and therefore in scope, with its own scenario and owner. Clarify and record the scope boundary, cross-reference the enterprise register, and route it accordingly.
The same screening should be applied to every unit entry, because inconsistent scope damages aggregation as much as inconsistent scales. A single out-of-scope item at the top of a register also undermines confidence in the whole list.