Information Security: Risk Acceptance and Policy Exception Reporting

Original Issuance Date: October 13, 2020
Last Revision Date: November 11, 2026
Effective Date: May 1, 2027

1. Purpose of Procedures

This procedure establishes requirements for enterprise IT risk reporting across the University of Wisconsin (UW) System. The reporting process provides system-wide visibility into significant IT risks, common trends, shared exposures, and other concerns that may warrant coordinated action, leadership attention, or enterprise-level investment.

2. Responsible UW System Officer

Associate Vice President for Information Security

3. Definitions

Please see SYS 1000, Information Security: General Terms and Definitions, for a list of general terms and definitions. Terms and definitions found within this procedure include:

Risk
Risk Owner
Residual Risk

4. Procedures

A. Enterprise Risk Reporting

Each institution must participate in enterprise IT risk reporting according to a recurring schedule established by the UW System Office of Information Security.
For each reporting cycle, institutions must provide a prioritized set of their most significant identified IT risks. The Office of Information Security will establish the number of risks requested, reporting format, and submission method through supporting guidance.
Institutions must review their most significant IT risks with appropriate IT and institutional leadership as part of the reporting process.
The Office of Information Security may request additional information or updates between reporting cycles when necessary to support enterprise risk awareness or analysis.
Enterprise IT risk reporting does not transfer risk ownership or decision-making authority to the Office of Information Security, and reporting a risk does not constitute approval or acceptance of the risk. The Office of Information Security may request supporting records when necessary to understand a reported risk or its potential enterprise implications.

B. Reporting Information

For each reported risk, institutions must provide, at a minimum:

A risk statement describing the potential event or condition and potential impact.
The affected area or relevant institutional context.
The residual risk rating.
The assigned risk owner.
The selected risk response and current status.

Additional reporting information may be identified through supporting guidance.

C. Enterprise Analysis and Use

The Office of Information Security will maintain a central risk register of significant reported risks and aggregate and analyze reported risks to identify common themes, shared or systemic exposures, emerging concerns, and opportunities for coordinated mitigation, investment, policy, guidance, or other enterprise action.