Ark School · 7 min read

Colombia's public-sector risk guide, version 7, explained

Colombia's public entities manage their risks with the Comprehensive Risk Management Guide for Public Entities, issued by the Administrative Department of the Public Service (DAFP). Version 7 dates from August 2025. This guide sums up its arithmetic, which is what gets asked about most and applied wrongly most often.

Two impacts, not four

The guide recognizes only two impact areas: economic (or budgetary) and reputational. Sanctions, compensation, legal and operational effects are not separate dimensions: they are expressed as economic or reputational impact. If a risk has both, the higher one counts.

Likelihood measures exposure

It does not ask how many times the problem occurred, but how many times a year the activity where it can occur is carried out. A procedure performed five thousand times a year is more exposed than one performed twice, even if neither has failed yet. In technology, each hour of operation counts as one time.

Very low, 20%: up to 2 times a year.
Low, 40%: 3 to 24 times.
Medium, 60%: 25 to 500 times.
High, 80%: 501 to 5,000 times.
Very high, 100%: more than 5,000 times.

Economic impact is measured in minimum wages

Slight, 20%: less than 10 monthly minimum wages (SMLMV).
Minor, 40%: between 10 and 50.
Moderate, 60%: between 50 and 100.
Major, 80%: between 100 and 500.
Catastrophic, 100%: more than 500.

Reputational impact has one descriptor per level, from what affects one area of the entity to what reaches national level. The entity may adjust the frequency and money ranges to its size; the five levels and their percentages are not changed.

The matrix has four zones

Likelihood and impact cross on a 5 × 5 matrix with Low, Moderate, High and Extreme zones. Two rules can be read at a glance: every catastrophic impact falls in Extreme and every major impact falls in High, whatever the likelihood. For public integrity risks the matrix admits no adjustments.

A control is worth type plus implementation

Each control gets a percentage that comes from adding two attributes:

Type: preventive 25%, detective 15%, corrective 10%.
Implementation: automatic 25%, manual 15%.

A manual preventive control is worth 40%, and a manual detective one, 30%. Preventive and detective controls lower likelihood; corrective ones lower impact. The control's documentation, frequency and evidence are analysed, but they do not score. And a warning from the guide itself: backups and insurance policies are corrective controls. Counting them as preventive overrates the control.

Residual risk is cumulative

Control percentages are not added together. Each control is applied to what the previous one left.

Example · A full calculation

A risk with Medium likelihood (60%) and Major impact (80%) sits in the High zone and has two controls. The manual preventive one is worth 40%: 60% × (1 − 0.40) = 36%. The manual detective one is worth 30% and is applied to that result: 36% × (1 − 0.30) = 25.2%, which corresponds to the Low level. As there are no corrective controls, impact stays at 80%. Residual risk remains in the High zone: likelihood dropped one level and the zone did not move. Getting it out of there takes a corrective control or an action plan.

How the risk is worded

The guide proposes a formula with three parts: the effect (economic or reputational), the immediate cause and the root cause. For example: “Possibility of economic loss through payment of an invoice that does not meet requirements, because supporting documents are reviewed by a single person”. The root cause is what the control must attack.

Information security and public integrity

The chapters on information security and on public integrity use the same tables, the same matrix and the same way of rating controls. In information security the threat is the immediate cause, the vulnerability is the root cause and the controls come from Annex A of ISO/IEC 27001. Public integrity covers corruption, bribery, fraud, conflict of interest, money laundering and terrorist financing.

What the guide does not cover

It is written for public entities and works as a minimum standard: an entity may adjust the method if the adjustment is compatible and does not weaken it. It does not regulate private companies, which follow SAGRILAFT or SARLAFT for money laundering and may choose their own method for their other risks.

Risk, the tool The Ark of ISO offers, includes a DAFP v7 profile that calculates with this same arithmetic and exports the General Report and the Treatment Plan. This guide is an explanation; the official document is published by the Función Pública.