How do you perform risk classification? What is the difference between low, medium and high-risk classification?

The risks should be classified as per the policy of the company. There are various risk classifications that can be defined as per risk priority and company policy:

Critical-

For risks that contain the company’s critical assets that may be compromised by fraud or system disruptions, Critical Classification is done.

High-

Physical or monetary loss or system-wide disruption includes fraud, loss of any asset or failure of a system are included.

Medium-

Multiple system disruptions like overwriting master data in the system are included in this.

Low-

These are the risks in which either productivity losses or system failures are compromised by fraud or system disruptions. In this, the loss is said to be minimum.