This page combines our Risk Management Policy (methodology) with the Risk Register (the live tracked-risks list). External auditors usually want to see these together. Both are reviewed quarterly and whenever a material change occurs.
Purpose
Denialbase’s risk management process:- Identifies risks to the confidentiality, integrity, and availability of information assets.
- Assesses likelihood and impact to produce a consistent severity score.
- Decides treatment: mitigate, transfer, accept, or avoid.
- Tracks treatment actions to completion.
- Monitors residual risk and reviews periodically.
Methodology
Scope of assessment
- All information assets listed in our asset inventory (applications, infrastructure, data, processes).
- All workforce + vendor relationships.
- All changes to scope trigger a delta assessment.
Identification
Risks are identified from:- Threat intelligence — industry advisories, CVE monitoring, healthcare-specific threat reports.
- Audit findings — internal and external.
- Incident reviews — root causes of actual incidents.
- Vendor changes — new subprocessors, changed terms, vendor breaches.
- Architecture reviews — new features, new data flows, new integrations.
- Workforce input — anyone can propose a risk; reviewed at next risk meeting.
- Annual threat modeling workshop — facilitated STRIDE walkthrough of the full stack.
Assessment — 5×5 matrix
Each identified risk is scored on two dimensions: Likelihood (probability the risk materializes in the next 12 months):
Impact (consequence if it does):
Inherent risk score = Likelihood × Impact (range 1–25).
Residual risk score = Likelihood × Impact after controls are applied.
Rating bands
Treatment decisions
For each risk above the Low band, choose one:- Mitigate — implement controls to reduce likelihood and/or impact.
- Transfer — contractually shift risk (insurance, BAA indemnification, vendor SLA).
- Accept — document acceptance with rationale and expiry (maximum 12 months, renewable).
- Avoid — eliminate the source (e.g. don’t use the vendor, don’t build the feature).
Risk acceptance
For risks we choose to accept (i.e. not fully mitigate):- Documented in the register with rationale.
- Expiry — acceptance is time-bound (default 6 months).
- Compensating controls — any alternative mitigations in place.
- Approval — Security Officer for Medium/High; CEO + Security Officer for Critical.
- Review — acceptance revisited at every management review.
Communication
- Top-5 risks reported to every management review.
- Critical or High risks with customer-visible implications reported on the Trust Center (this page).
- Internal risk register (with owner names, ticket links, evidence paths) available to all workforce via Google Drive.
Review cadence
Register (public snapshot — April 2026)
Critical (score 16–25)
None currently. All Critical risks from the April 2026 audit review have been moved to active treatment with progress tracked quarterly.High (score 10–15)
Medium (score 5–9)
Low (score 1–4)
Tracked internally; not repeated here. Examples include: ESLint rule coverage gaps, documentation freshness drift, minor UX issues with DR runbook clarity.Relationship to other documents
- Every audit finding with residual risk becomes a risk register entry.
- Every risk treatment decision is tracked to closure.
- Every quarterly review updates the register and carries outputs into the next management review.