Defining scope of a loss
Scope of a loss enables definition of location of the loss, the associated incident and therefore a risk within the organization.
Organization description is detailed in chapter Managing your IRM Environment. The scope is specified on several component types:
• entities concerned by the loss
An entity can be internal or external to the enterprise: an entity represents an organizational element of enterprise structure such as a management, department, or job function. It is defined at a level depending on the degree of detail to be provided on the organization (see org-unit type). Example: financial management, sales management, marketing department, account manager. An external entity represents an organization that exchanges flows with the enterprise, Example: customer, supplier, government office.• business lines concerned by the loss
A business line is a skill or grouping of skills of interest for the enterprise. It corresponds for example to major product segments, to distribution channels or to business activities.• risk typesto be associated with the loss
A risk type defines a risk typology standardized within the context of an organization.• business processes andorganizational processes concerned by the loss
A business process represents a system that offers products or services to an internal or external client of the company or organization. At the higher levels, a business process represents a structure and a categorization of the business. It can be broken down into other processes. The link with organizational processes will describe the real implementation of the business process in the organization. A business process can also be detailed by a functional view.An organizational process describes how to implement all or part of the process required to make a product or handle a flow.• products impacted by the loss
A product represents commodities offered for sale, either goods or merchandise produced as the result of manufacturing, or a service, ie. work done by one person or group that benefits another.• applications impacted by the loss
An application is a set of software tools coherent from a software development viewpoint.• requirements expected related to loss management
A requirement is a need or expectation explicitly expressed, imposed as a constraint to be met within the context of a project. This project can be a certification project or an organizational project or an information system project.