This risk management framework is based on ISO 31000 standard, which provides principles and guidelines for effective risk management. The context of this work is to provide Nexus Mutual risk assessors a systematic approach to identify, analyze, and evaluate risks. The actual treatment or mitigation of risks is not in scope of this framework.
The term risk assessment is used within this organization to describe the following process:
- Risk identification: identifying risks; in this step the eligibility of potential claim payouts is not considered (this makes the risk assessment more adaptable to cover wording changes). In most cases the risk register can be used as a starting point.
- Risk analysis: understanding the sources and causes of the identified risks; studying probabilities and consequences given the existing controls, to identify the level of residual risk.
- Risk evaluation: comparing risk analysis results with (quantifiable) risk criteria to determine whether the residual risk is tolerable in terms of staking.
Nexus Mutual currently offers different cover types. Therefore, dedicated information to perform risk assessments will be elaborated individually for each cover type:
- Protocol
- YieldToken (work in progress)
- Custodian (work in progress)
Monitoring and review consists of periodically measuring risk management performance against indicators. It involves checking whether the risk management framework and risk assessment results are still appropriate and if accepted claims by Nexus Mutual. Payouts and incidents will be tracked separately, used as risk management performance indicators and if necessary will lead to improvements of this risk management framework.
The elaborated risk management framework does not constitute an offer to provide investment advisory. Any and all liability for risks resulting from potential claims or unexpected events is expressly excluded. All the information made available by this Github organization is generally provided to serve as an example only, without obligation and without specific recommendations for action.