Describing Risks
To be able to assess risks in the framework of assessment campaigns by questionnaires, you must first specify certain properties. For more details, see Preparing the Assessment Work Environment.Risk characteristics
To access characteristics of a risk:
Select a risk form a list of risks or key risks and click the Properties button.The properties page of the risk appears in the right pane.
On this page you can specify for the control:
• the risk identification Code
• the risk Name
• the fact that the risk is high level by selecting the Key Risk check box
• the risk Owner
• the risk Identification Mode
The risk could have been identified from:
• an "incident database"
• a "workshop"
• a "survey"
• an "audit"
• the risk Description
the Risk Status appears grayed and cannot be modified since it is managed by the workflow associated with the risk.Risk scope
Risk scope enables definition of risk location. It relates to several component types:
An entity can be internal or external to the enterprise: an entity represents an organizational element of enterprise structure such as a management, department, or job function. It is defined at a level depending on the degree of detail to be provided on the organization (see org-unit type). Example: financial management, sales management, marketing department, account manager. An external entity represents an organization that exchanges flows with the enterprise, Example: customer, supplier, government office.• Business Processes and Organizational Processes exposed to the risk. For more details, see "Managing Processes", page 13.
A business process represents a system that offers products or services to an internal or external client of the company or organization. At the higher levels, a business process represents a structure and a categorization of the business. It can be broken down into other processes. The link with organizational processes will describe the real implementation of the business process in the organization. A business process can also be detailed by a functional view.An organizational process describes how to implement all or part of the process required to make a product or handle a flow.• Objectives and Requirements expected related to risk management. For more details, see "All Objectives", page 22 and "Consulting Requirements", page 23.
An objective is a goal that a company or organization wants to achieve, or is the target set by a process or an operation. An objective allows you to highlight the features in a process or operation that require improvement.A requirement is a need or expectation explicitly expressed, imposed as a constraint to be met within the context of a project. This project can be a certification project or an organizational project or an information system project.An application is a set of software tools coherent from a software development viewpoint.A business line is a skill or grouping of skills of interest for the enterprise. It corresponds for example to major product segments, to distribution channels or to business activities.