Skip to main content
All policies

Ethics and Governance

Risk Management Policy

A draft likelihood × impact method; no approved risk register yet.

Version
1.0
Effective
7 November 2026
Owner
Board of Directors, International Social Benefit Association
Review
At least once a year
Category
Ethics and Governance
Last updated
7 November 2026

The binding versions are Turkish and English; if they differ, the Turkish text prevails.

Text language

1. Purpose

To explain how we identify, assess and handle risks that could affect hangel's services, users, data, financial resources and reputation.

2. Scope

All activities of the International Social Benefit Association and the hangel platform. Main risk areas: information security and personal data, life-critical flows (emergency blood requests, disaster announcements), money flows (transfers to NGOs), safety of children and vulnerable groups, legal compliance, supplier dependency, key-person dependency and reputation.

3. Principles

  1. Scenario-based assessment. Using the question: "Which threat, through which weakness, could cause what harm to what?"
  2. Likelihood × impact. Risks are scored on a 1–5 likelihood and a 1–5 impact scale; for impact, the highest of personal data, service interruption, legal/reputational and financial dimensions is used.
  3. Life-critical first. Risks affecting personal safety, health data and money transferred to NGOs take priority.
  4. Four options. Reduce, avoid (for example by not collecting unnecessary data), share (contract, insurance) or accept with justification.
  5. Ownership. Every risk has an owner and a treatment date.

4. Roles and responsibilities

  • Board of Directors: sets the risk appetite and decides whether to accept or treat high and critical risks.
  • Technical lead: monitors information security and infrastructure risks.
  • Risk owners: carry out the treatment plans for their risks.

5. How it works at hangel today

  • Draft method: An assessment method for information security risks guided by ISO/IEC 27005 (ISMS-03) has been drafted: scores 1–25; 1–4 low, 5–9 medium, 10–16 high, 20–25 critical.
  • Code and security reviews: The platform's code is reviewed periodically; findings are tracked in the repository with priorities (P0, P1…) and a task list.
  • Automated tests: Database access rules and critical calculations (for example donation distribution) are protected by automated tests.
  • Continuous monitoring: Errors are monitored with Sentry; a health endpoint is checked every 5 minutes.
  • Incident log: Personal data breaches are recorded in the breach records of the super-admin panel (date, summary, number of people affected, data types, status).
  • Limits in life-critical flows: The emergency blood module does not provide medical diagnosis or guarantees; it is only an information and matching tool.

6. Not yet in place and our goals

  • There is no approved risk register (ISMS-04); the draft method is awaiting Board approval.
  • Risk acceptance criteria and financial impact thresholds have not been set.
  • Risks outside information security (financial, legal, key-person, reputational) are not assessed regularly.
  • No annual risk report is presented to the Board.

7. How to raise a concern

Anyone who notices a new risk or weakness: info@hangel.org (for security vulnerabilities, subject "Security report").

8. Review

At least once a year; interim assessment after a new service, supplier, cloud region or significant incident.

9. Related documents

Crisis and Business Continuity Policy · Information Security Policy · Compliance Management Policy · Existing "Risk Management and Crisis Response Policy" and "Corporate Risk and Compliance Committee Statement"

Related texts

All policies