Risk Articulation Articulation Translation to Risk Register Incorrect risk name: Cause Effect Impact Best Practice Risk Identifier “Information Governance” (Literally translated, this is stating that we are at risk of having Information Governance) Failure to have governance in place to meet legal requirements. Human error, poor processing AND/OR Technical errors, weak IT systems, access rights not restricted appropriately (hackers) A breach of current data protection legislation which results in the loss of confidentiality, integrity or availability of personal data. Fine (up to €20m), financial impact (costs of improvements, recovery, enforcement action, legal claims) , reputational damage, impact on individuals (damage and/or distress) Data breach or incident due to lack of good governance or due to human error (OR technical error/weak system) resulting in fines of up to €20m, significant reputational damage and financial impacts as well as damage and/or distress to individuals. Translation to Risk Register Risk Area Risk Identifier Information Governance Data breach or incident due to lack of good governance or human error resulting in fines of up to €20m, significant reputational damage and financial impacts as well as damage and/or distress to individuals. Information Security Data breach or incident due to technical error/weak IT system resulting in fines of up to €20m, significant reputational damage and financial impacts as well as damage and/or distress to individuals. Updated September 2018