Context establishment
Domain 4 - Context establishment
This domain tests whether you can set the boundaries and criteria before assessing anything. Weak context causes scope creep, inconsistent scoring and unaccepted risk decisions later.
Core rules
- Establish external and internal context: business objectives, legal and regulatory obligations, stakeholders, dependencies, capabilities, culture and constraints.
- Define scope and boundaries: processes, information assets, locations, technologies, third parties and interfaces. Record exclusions, assumptions and constraints.
- Set risk criteria: consequence and likelihood scales with calibrated descriptions, risk levels, acceptance criteria, treatment priority rules and risk appetite or tolerance.
- Distinguish risk appetite (the amount and type of risk an organisation is willing to pursue), risk tolerance (acceptable deviation) and risk capacity (the maximum it can bear).
- Decide the assessment approach, roles, communication plan and review cycle before starting.
Worked example
A hospital scopes risk management for its electronic patient record. The team includes clinical workflows, the cloud hosting provider and medical devices that exchange data; it excludes a research database but records why. Consequence scales cover patient safety, legal breach, financial loss and reputation. The board sets a tolerance: no risk above medium affecting patient safety. A 5x5 matrix is used with defined descriptors. Reasoning: scope and calibrated criteria make later scores comparable and acceptance defensible.
Traps
Defining criteria after scoring; excluding a critical supplier because it is 'external'; using an uncalibrated 5x5 matrix where 'high' means different things to different teams; confusing appetite with tolerance; leaving assumptions undocumented.