PROCESS MAPPING AND RISK MODELING SUMMARY This component allows an auditor to lead the host organization's staff in a series of activities to identify and prioritize the processes that are critical for the organization to carry out its work. These activities will also reveal the consequences if those critical processes were interrupted or exposed to a malicious actor. This results in the staff creating a risk matrix which is used as the foundation of the auditor's recommendations. PURPOSE Having the host organization central to the risk assessment process allows the auditor to put their threats and recommendations into the host's own narrative. With greater ownership of the process the staff will be more engaged in addressing the threats identified when the audit is complete. 67 By engaging as many staff as possible the auditor also is providing a framework for staff to examine future concerns when the auditor is gone. The existing in/formal security practices captured during this process will be used to remove organizational and psyco-social barriers to starting new practices. THE FLOW OF INFORMATION Information Threats Results Threats Activity Actors Actors Capacity Capacity Activities Activities Vulnerabilities Vulnerabilities Barriers Barriers Assets Assets Risk Modeling Information Flow GUIDING QUESTIONS What are the critical organizational activities? What threats does the organization, its programs, partners, and beneficiaries face? What would the impact of these threats be if they were to occur? What adversaries (people or groups) may attempt to carry out threats? Are those adversaries capable of carrying out these threats? APPROACHES Process and/or data mapping exercises One-on-One interviews with staff to supplement other group activities. Risk identification based on process or data mappings A classic group Risk Assessment Activity. Page 135 of 240