What are Risk Sources

Explanation of Risk Sources in Simple Terms

• A risk source is where risks originate or become apparent. For businesses, these are typically your processes or assets.

Why Companies Need to Know Risk Sources 

• A risk source is where risks originate or become apparent.
• When your risk sources encounter hazards, threats, or other events, they can trigger risks.
• Your company's assets or processes are fundamental risk sources because risks often start within or involve them.
• Threats and hazards themselves (factors and conditions that cause risks) are also sometimes considered risk sources.

Processes are Risk Sources

• Processes become a source of risk when they are inefficient, poorly designed, or poorly managed. For example:
• Business processes prone to human errors.
• Operational inefficiencies leading to delays or cost overruns.
• Insufficient quality control causing defective products.

Assets are Risk Sources

• Risks arise from assets (e.g., physical assets, financial assets, intellectual property, human resources). 
• Risks appear when threats, vulnerabilities, or hazards interact with these assets.

Why It Is Important to Know the Sources of Risks

• Correctly identifying the sources of risk allows for a more accurate evaluation and the implementation of appropriate measures.
• Understanding these sources is crucial for effective risk assessment and mitigation.

Risk Sources vs Risk Causes

Definition of Risk Causes

• The factors, actions, or events that trigger a risk scenario or event.
• These are mechanisms or conditions that exploit the risk source, turning potential risks into actualized events.

Hazards

• Hazards are external or internal conditions that could cause harm, such as natural disasters, dangerous substances, or unsafe working environments.
• Hazards are considered direct risk sources, particularly in safety and environmental risk management contexts.

Threats

• Threats are active agents or events that can exploit vulnerabilities to cause harm, such as cyberattacks, fraud, or geopolitical instability.
• They are a primary source of risk, especially in information security and strategic contexts.

How to Manage Risk Sources in Aptien GRC

Tip: It's recommended to have a list of key processes and assets ready for selection.

1. Open the risk register.
2. Select a specific risk.
3. Go to the Details tab.
4. Select risk sources from the list (assets, processes).