As risk is commonly defined as impact * likelihood or probability, impact is frequently the value of the asset or the value of the time of the asset being unavailable. I would like to be able to calculate risk by having each asset have two values: value, and value per hour down which could be used to calculate risk through multiplication with the probability of the risk event occurring. This would permit asset specific risk calculations, as the risk of an event for one asset is often rather different for the same event happening to a different asset.
we have met literally thousands of companies, one thing im sure is that “commonly” does not exist in risk frameworks and their implementation on companies, this is why eramba cant suit everyone’s need without code customisation.
i think from what you are saying the closest thing we have is “magerit” , have you reviewed it?
I had not. I’ll review this. Walt
I’ve attempted Magerit, with the following results: I added a new classification to every asset that would be used in the Magerit equation, called it primary loss magnitude. I instructed Magerit to take this value to determine the impact. I then told Magerit to use the event frequency classification from the asset risk to represent likelihood. Primary loss magnitude is populated for every asset. When I look at the asset based risks, however, instead of allowing me to use the classification, I get an error:
It seems you aret trying to use Magerit as a calculation method but one of the following is missing:
One or more asset classifications have missing numeric value (Asset Management / Settings / Classifications)
One or more identified assets (Asset Management / Asset Identification) are missing some classification
It would appear that Magerit is looking for two classifications from the asset to determine risk value
Much like the native eramba risk classification is using two classifications from the risk to calculate the risk’s value
What I need is to be able to combine impact associated with the asset (the asset value if you will) with the likelihood of the risk event happening.
In other words, likelihood needs to be a property of the “asset based risk” and impact needs to be a property of the “asset”.
Any hope of enabling that in a future release of the product?
Check the assets you have input on the risk, they miss at least one classification definition (using the image above, you need to classify the asset with an option not leave them as default). This is why you get that error…for example, the image below shows what is wrong (the third classification is not “selected”).