# Department Risk Scores
URL: https://docs.autociso.io/console/ciso-reports/department-risk/
Description: This report breaks down access hygiene by organizational department, enabling targeted remediation and holding department heads accountable for the access health of their teams.

*This is the help text the console shows in the help panel on this page.*

This report breaks down access hygiene by organizational department, enabling targeted remediation and holding department heads accountable for the access health of their teams. [Employees with no department](https://docs.autociso.io/console/directory/employees/) are grouped under "Unknown".

### How Scores Work
Each department is scored from its employees' [active access grants](https://docs.autociso.io/console/access/inventory/):
- **Avg Risk**: The average risk score across the department's active access grants.
- **Excessive Perms**: Active grants with a risk score of 70 or more.
- **Stale Accounts**: Active grants that are [dormant (no recent activity)](https://docs.autociso.io/console/ciso-reports/stale-accounts/).
- **Open Findings**: Currently shown for completeness; it is not yet populated per department.

### Visualizations
- **Horizontal Bar Chart**: Ranks all departments by average risk score. Click a bar to filter the table to that department.
- **Department Breakdown table**: **Employees**, **Total Access**, **Excessive Perms**, **Open Findings**, **Stale Accounts** and **Avg Risk** for each department.

The stat cards show **Departments**, **Highest Risk Dept**, **Avg Risk Score** and **Depts at High Risk** (average risk of 70 or more).

### Using the Data
- Click a department row (or a chart bar) to filter to it, then click **Clear filter** to see all departments again.
- Export the table with **CSV** or **PDF** and share it with department managers during quarterly business reviews.
- Use the scores to prioritize which teams should complete the next access review first.

### Benchmark
Departments with risk scores above the organizational average should be scheduled for a [focused access review campaign](https://docs.autociso.io/console/iso/access-reviews/) before the next audit window.