Spreadsheet: 763350d1642116153-how-to-auto-populate-values-based-on-multiple-criteria-sample
Sheet: Risk Categories

 | OPS RISK CATEGORIES AND DESCRIPTIONS
 | Risk categories are made up of risk events that fall into common groups.
 | Category | Operational | Strategic | Environmental
 | Operational | Human Resources | Cultural | External
 | Strategic | Finance | Governance
 | Environmental | I&IT | Reputational
 |  | Program Delivery | Other
 |  | Policy
 |  | Project/Initiative
 |  | Legal
 |  | Regulatory
 |  | Emergency Management
 |  | Infrastructure
 |  | Physical Security
 |  | Other
 | CATEGORY | SUB CATEGOTY | [NAME]
 | Operational | Human Resources | Uncertain event or opportunity in operations carried out by the ministry, | related to human resource management, employment standards, employee benefits or recruitment.
 |  | Finance |  | related to obtaining, using or maintaining economic resources; meeting overall financial budgets/commitment; borrowing, investments and financial risk management activities.
 |  | I&IT |  | related to information, communications and/or computer systems, in the context of business operations.
 |  | Program Delivery |  | related to the delivery of a specific program.
 |  | Policy |  | related to policy objectives, delay in policy approvals and/or policy outcomes.
 |  | Project/Initiative |  | related to the management and/or delivery of a specific project or special initiative.
 |  | Legal |  | related to legal uncertainty, litigation and contractual obligations.
 |  | Regulatory |  | related to compliance to laws, regulations and directives applicable to the ministry.
 |  | Emergency Management |  | related to emergency management, preparedness and/or continuity of operations.
 |  | Infrastructure |  | related to resources, facilities and systems that support its sustainable functionality.
 |  | Physical Security |  | related to the protection of employees, hardware, software, networks and data.
 |  | Other |  | related to other issues not captured above.
 | Strategic | Cultural | Uncertain event or opportunity related to the ministry’s strategy or strategic objectives, | related to the ministry’s culture.
 |  | Governance |  | related to the ministry’s governance structure.
 |  | Reputational |  | related to public perception, stakeholders and media attention toward the ministry.
 |  | Other |  | related to other issues not captured above.
 | External Environment |  | Uncertain event or opportunity related to the ministry’s external environment.
 | RATING | LEVEL | IMPACT LEVEL EXAMPLES (IF RISK MANIFESTS
 | 1 | Insignificant | Strategy: No impact on strategies.
 |  |  | Operational/Delivery: No impact on government services that affect the organization and its assets, the environment, the core administration of justice and the economy, including the ability to deliver on key commitments.
 |  |  | Reputation: No adverse publicity or public complaint.
 |  |  | Regulatory/Compliance: No incident(s) of non-compliance or no breach in financial accountability and transparency obligations or the Public Service of Ontario Act.
 |  |  | Health & Safety: No disruption of key services that protect public health, life and safety. No breach of duty of care to maintain the health, physical safety and wellbeing of employees, or non-compliance with legislation that binds us as an employer. No disruption to emergency management or nuclear preparedness planning or response.
 |  |  | I&IT: No disclosure, modification or loss of availability of IT systems. Minor privacy or cybersecurity incidents.
 |  |  | Financial: Allocation/budget variance is less than 0.5% of ministry allocation, and it is less than $50M.
 | 2 | Minor | Strategy: Minor impact on strategic objectives resulting in minor delay or minor failure in seizing opportunities to improve core mission/mandate execution.
 |  |  | Operational/Delivery: Minor impact (in one week) to government services that affect the organization (and its assets), environment, core administration of justice, or economy.
 |  |  | Reputation: Negative media tone (1 or 2 out of 7 days).
 |  |  | Regulatory/Compliance: Minor incident(s) of non-compliance. Minor breach in financial accountability and transparency obligations or the Public Service of Ontario Act.
 |  |  | Health & Safety: Small scale disruption of non-key services provided to protect the public’s health, life and safety. Minor incident/breach of duty of care to maintain the health, physical safety and wellbeing of employees, or non-compliance with legislation that binds us as an employer. Minor disruption that may compromise support to emergency management or nuclear preparedness planning or response.
 |  |  | I&IT: Unauthorized disclosure, modification or loss of availability of IT systems that result in minor financial loss, slight embarrassment, or minor inconvenience. Privacy or cybersecurity incidents in areas that do not compromise public safety, or have a minor economic impact, or minor loss of confidence in government.
 |  |  | Financial: Allocation/budget variance is between 0.5% to 1% of ministry allocation, and it is less than $100M.
 | 3 | Moderate | Strategy: Failure to meet some strategic objectives resulting in moderate delay or some lost opportunities to improve execution of core mission/mandate going forward.
 |  |  | Operational/Delivery: Moderate impact (in two or more weeks) to government services that affect the organization (and its assets), environment, core administration of justice, or economy.
 |  |  | Reputation: Negative media tone (2 or 3 out of 7 days).
 |  |  | Regulatory/Compliance: Incident(s) of moderate non-compliance or moderate breach in financial accountability and transparency obligations or the Public Service of Ontario Act.
 |  |  | Health & Safety: Some potential disruption of some services provided to protect the public’s health, life and safety, and services to clients that affect their health, life and safety. Small-scale incidents/breaches of duty of care to maintain the health, physical safety and wellbeing of employees, or non-compliance with legislation that binds us as an employer. Moderate disruption compromising aspects of emergency management or nuclear preparedness planning or response.
 |  |  | I&IT: Unauthorized disclosure, unauthorized modification or loss of availability of IT systems that result in moderate personal/enterprise injury, financial loss, embarrassment, or inconvenience. Privacy or cybersecurity breaches, only in areas that do not compromise public safety.
 |  |  | Financial: Allocation/budget variance is between 1% to 2% of ministry allocation, and it is less than $200M.
 | 4 | Major | Strategy: Failure to meet important ministry strategic objective(s) resulting in significant delay or partial failure in meeting core mission/mandate going forward.
 |  |  | Operational/Delivery: Immediate impact (in one week) to government services that affect the organization (and its assets), the environment, core administration of justice or economy.
 |  |  | Reputation: Prolonged negative headlines. Significant national press attention.
 |  |  | Regulatory/Compliance: Two incident(s) of material noncompliance or major breach in financial accountability and transparency obligations or the Public Service of Ontario Act.
 |  |  | Health & Safety: Immediate but not prolonged disruption of services to protect the public’s health, life and safety. Multiple breaches of duty of care to maintain the health, physical safety and wellbeing of employees, or major non-compliance with legislation that binds us as an employer. Major disruption compromising emergency management or nuclear preparedness planning or response.
 |  |  | I&IT: Unauthorized disclosure, modification or loss of availability that could result in major personal or enterprise injury, loss of competitive advantage, loss of confidence in government program(s), major financial loss, or damage to partnerships or reputations. Single program/area privacy or cybersecurity breaches that could compromise public safety, have a major economic impact.
 |  |  | Financial: Allocation/budget variance is between 2% to 5% of ministry allocation, and it is less than $500M.
 | 5 | Critical | Strategy: Failure to meet crucial strategic objective(s) resulting in failure to meet core mission/mandate going forward.
 |  |  | Operational/Delivery: Immediate impact (in less than one week) to government services that affect the organization and its assets, environment, core administration of justice, or the economy.
 |  |  | Reputation: Sustained lead story and adverse national/international coverage, multiple media types. Significant negative public confidence loss in less than 1 week, and/or ability to deliver on government key commitments.
 |  |  | Regulatory/Compliance: Non-compliance with legislation with widespread impact to health safety and wellbeing of employees. Severe breach in financial accountability and transparency obligations or the Public Service of Ontario Act (major criminal investigation).
 |  |  | Health & Safety: Prolonged and/or widespread disruption (in less than one week) of services provided to protect the public’s health, life and safety, and services to clients that affect their health, life and safety. Widespread breach of duty of care to maintain the health, physical safety and wellbeing of employees, or non-compliance with legislation that binds us as an employer. Disruption significantly compromising all emergency management or nuclear preparedness planning or response.
 |  |  | I&IT: Large scale privacy or cybersecurity breaches that could compromise public safety, have a major economic impact, or result in significant financial loss, result in significant loss of confidence in or embarrassment to government.
 |  |  | Financial: Allocation/budget variance is greater than 5% of ministry allocation, and it is greater than $500M.