HOPEX V5 EN

HOPEX IRM > HOPEX IRM Common Features > Managing your IRM Environment > Organization > Managing Processes

Managing Processes

Available process types are:

• business processes

A business process represents a system that offers products or services to an internal or external client of the company or organization. At the higher levels, a business process represents a structure and a categorization of the business. It can be broken down into other processes. The link with organizational processes will describe the real implementation of the business process in the organization. A business process can also be detailed by a functional view.

• organizational process

An organizational process describes how to implement all or part of the process required to make a product or handle a flow.

Accessing processes

To access the business / organizational process tree:

In the HOPEX IRM desktop, click Environment > Organization > Processes.

Root business and organizational processes are displayed.

Process hierarchy

The hierarchy of processes/operations is as follows:

For each process of the hierarchy the following is displayed:

• Risks (directly connected to processes)

• Controls (directly connected to risks, which are in turn connected to processes)

• Controls (directly connected to processes)

The following columns are available:

• Risks (number of)

• Controls (number of)

• Last assessment

• Residual risk

The residual (or net) risk indicates the risk to which the organization remains exposed after management has processed the risk.

• Forecast risk

Forecast risk represents the residual risk forecast for the year to come.

• Latest compliance rate

The compliance rate is the percentage of “Pass” controls.

• Control level

The Control level characterizes the efficiency level of control elements deployed (controls) to mitigate the risk.

Specifying process characteristics

To access the characteristics of a process:

Open the Characteristics page of the process properties.

The Owner is responsible for global operation of the process in terms of effectiveness, profitability and security.

Specifying process scope

A process can be linked to different objects types.

A specific page is available in the process properties for each object type:

• Risks: risks that relate to the process.

For more details, see Managing Risks.

• Controls: controls that relate to the process.

For more details, see Managing Controls.

• Incidents

• Action plans

To view regulations impacting a process, expand the Regulatory Impact section.

Specifying process responsibilities

Responsibilities on a process are shared by persons with different roles.

To specify responsibilities on a process:

In the process properties, expand the Responsibilities section.

You can specify the following responsibilities:

• Accountable

• Consulted

• Informed

The above responsibilities correspond to the RACI responsibilities. See Responsibilities (RACI).

• Risk assessor

The Risk assessor is responsible for assessing risks within his scope, as well as implementing action plans related to these risks.

You can define several risk assessors on the same entity.

• Control assessor

The Control assessor is responsible for assessing and executing controls within his/her scope, as well as implementing action plans related to these controls.

You can define several Control assessors on the same entity.

Specifying sub-processes

To specify the sub-processes of a business process:

In the business process properties, expand the Sub-processes section.

You can specify:

• The business process components

• The connected organizational processes

To specify the sub-processes of an organizational process:

In organizational process properties, expand the Sub-processes and Operations section.

You can specify:

• organizational processes

• associated operations

Managing business continuity

These features are available with HOPEX BCM only.

To access the Business Impact Analyses (BIAs) and Business Continuity Plans (BCPs) associated to a business process:

Open business process properties and select the Business Continuity page.

For more details, see:

• Defining a Business Impact Analysis

• Designing a Business Continuity Plan

To add a business process to a BCM system:

In a business process pop-up menu, select Add to BCM system.

For more details, see Managing BCM Systems.

To create a Business Impact Analysis (BIA) from a business/organizational process:

Open the process pop-up menu and select Create a BIA.

Other sections of a process

The properties page of a process presents the following sections:

• Objectives: see Strategic Environment

• IT assets: It resources (applications, databases and servers) are made available for process implementation.

See Managing Applications.

• Entities that intervene in the process.

See Managing Entities.

• Business Lines: business lines that use the process services.

See Managing Business Lines.