Glossary: Governance, Risk and Compliance

risk statement (cause, event, consequence)

Also written: cause, event, consequence, risk statement

Writing each risk as one sentence with a cause, an event and a consequence, so it can be measured and owned. For example: because email has no second factor (cause), a phished password lets an attacker in (event), so they can send fake invoices (consequence).