Skip to main content

Risk Assessment Process

Purpose:​

The purpose of this policy is to outline the process for identifying, evaluating, and managing risks associated with the Pitaka platform, ensuring that potential threats to the platform and its users are effectively addressed.

Scope:​

This policy applies to all employees, contractors, and third-party users who access Pitaka systems and data.

Policy​

1. Risk Identification:​

Risks must be identified through various methods, including but not limited to: Internal audits: Regular assessments of systems and processes. User feedback: Gathering insights from users regarding potential vulnerabilities. Threat intelligence: Staying informed about emerging threats in the cybersecurity landscape.

2. Risk Analysis:​

Each identified risk must be analyzed to determine: The likelihood of occurrence (e.g., low, medium, high). The potential impact on the organization and its users (e.g., minor, moderate, severe). A risk matrix may be used to visualize and prioritize risks based on their likelihood and impact.

3. Risk Evaluation:​

Risks must be evaluated to determine whether they fall within acceptable levels based on the organization's risk appetite. Prioritization should be given to risks that pose the greatest threat to the organization and its users.

4. Risk Treatment:​

For each evaluated risk, appropriate treatment measures must be identified and implemented, which may include: Risk avoidance: Altering processes to eliminate the risk. Risk reduction: Implementing controls to mitigate the risk. Risk transfer: Sharing the risk with third parties (e.g., insurance). Risk acceptance: Acknowledging the risk when it is within acceptable limits.

5. Documentation:​

All identified risks, analysis results, evaluations, and treatment measures must be documented and maintained in a secure manner. Documentation should include details on the risk owner, action plans, and timelines for implementing risk treatments.

6. Monitoring and Review:​

The risk assessment process must be reviewed and updated on a regular basis, at least annually, or whenever significant changes occur within the organization or its environment. Ongoing monitoring should be conducted to track the effectiveness of implemented risk treatments and to identify new risks.

7. Training and Awareness:​

All employees must receive training on the risk assessment process and their role in identifying and managing risks. Continuous awareness programs should be established to keep users informed about risk management practices and updates.

This policy aligns with relevant regulations, including the Data Privacy Act of 2012 and the Cybercrime Prevention Act of 2012 in the Philippines. Regular audits should be conducted to assess compliance with this policy and the effectiveness of the risk assessment process.

9. Policy Enforcement:​

Violations of this policy may result in disciplinary actions, which may include revocation of access, termination of employment, or legal consequences, depending on the severity of the violation. The compliance officer is responsible for overseeing the risk assessment process and ensuring adherence to this policy.