• HOPEX GRC Common Features
  • About the GRC Manager Desktop
    • Accessing the GRC Desktop
      • Profiles used in GRC solutions
      • GRC Profiles/Solutions Summary
    • The GRC Documentation
  • GRC Functional Administration
    • Reusing Regulation Data
      • Converting Regulation Data
    • Managing Teams
      • Creating skill types
      • Creating skills
      • Creating skill levels
      • Viewing user skills
    • Managing Currencies
      • Defining Central Currency
      • Defining local currencies available to users
      • Specifying your local currency
      • Managing Exchange Rates
    • Configuring Time Sheets
    • Managing Campaign Calendars
      • Creating schedules
      • Creating calendar periods
      • Connecting a calendar to an audit or test plan
    • Managing Steering Calendars
    • Administrating Key Indicators
      • Accessing Indicator Administration Features
      • Defining Indicator Categories
      • Defining Indicator Interpretation logics
      • Defining Indicator Statuses
        • Creating indicator statuses
        • Computation of indicator statuses
        • Indicator status formulas
      • Defining Aggregation Periods and Methods
        • Aggregation periods
        • Aggregation methods
        • Creating aggregation periods or methods
      • Defining Key Indicator Value Computation Logics
        • Creating a computation logic
        • Computation logic via query
    • Exporting and Re-Importing GRC Objects
      • Exporting GRC Objects
        • Using the export wizard from the main menu
        • Exporting GRC objects from a list
      • Importing GRC Objects
  • GRC Environment Management
    • Organization
      • Managing Entities
        • Accessing organization entities
        • Creating an entity
        • Creating a sub- entity
        • Defining entity general characteristics
        • Specifying responsibilities within an entity
        • Scoping an entity
      • Managing Processes
        • Accessing processes
        • Process hierarchy
        • Specifying process characteristics
        • Specifying process scope
        • Specifying process responsibilities
        • Specifying sub-processes
        • Managing business continuity
        • Other sections of a process
      • Managing Business Lines
        • Accessing Business Lines
        • Connecting entities and processes to a business line
        • Defining risks and incidents that impact a business line
        • Entering gross revenues for incident management
      • Managing Applications
        • Accessing applications
        • Specifying application scope
    • Financial Environment
      • Accounts
        • Characteristics of an account
        • Connecting controls to an account
      • Products
      • Gross Incomes
    • Strategic Environment
    • Risk Environment
      • Describing Risk Environment
      • Defining the Environment of a Specific Risk
      • Risk types
        • Creating a risk type
        • Analyzing the impacts of a risk type
      • Risk Factors
      • Risk consequences
    • Control Environment
    • The Compliance Environment
      • Managing your Regulatory Environment
        • Using UCF Import
        • Creating Regulatory Content Manually
      • Managing Business Policies
      • Defining Applicable Regulations and Business Policies
        • Regulatory content applicability
        • Reviewing regulatory frameworks after UCF import
        • Selecting the regulatory content applicable to your organization
      • Defining the Scope of Regulations and Business Policies
    • Responsibilities (RACI)
      • Responsibility levels
      • Specifying Responsibilities
  • Key Indicators
    • Accessing Key Indicators
    • Defining Key Indicators
      • Creating a Key Indicator
      • Specifying the Aggregation Period and Method
      • Example of a Key Indicator
    • About Key Indicator Categories
      • Description of Key Indicator Categories
      • Relation between Indicator Category and Interpretation Logic
    • More Key Indicator Characteristics
      • Editing Key Indicator Parameters
      • Defining a Measurement Unit to be Displayed in Reports
      • Activating / Deactivating a Key Indicator
      • Specifying the Indicator Scope
      • Specifying Action Plans
      • Connecting Risks
    • Key Indicator Overview
      • Indicator Status
        • Default statuses
        • Information about indicator status computation
      • Time to Failure
      • Last Measurement of the Key Indicator
      • Key Indicator Value
    • Defining Measurement Frequency and Notifications
      • Specifying Measurement Frequency
      • Managing Notifications
      • Entering Periodic Key Indicator Values
        • Entering a key indicator value manually
        • Parameterizing automatic value entering
    • Viewing the Indicator Graph
  • Assessment Campaigns
    • Accessing Assessments by Profiles
    • Accessing Assessment Templates
    • Preparing the Assessment Environment
      • Prerequisites to Risk Assessment
      • Pre-requisites to Control Assessment
    • Starting an Assessment Campaign
      • Creating Assessment Campaigns
      • Creating an Assessment Session Manually
    • Completing Questionnaires
    • Following up assessments progress
      • Consulting Session Results
      • Viewing Assessment Campaign Results
      • Validating Assessment Questionnaires
      • Asking a Respondent to Modify Answers
      • Reassigning Questionnaires
  • GRC Reports
    • GRC Report Availability
    • Key Indicator Reports
      • Indicator comparator
      • Multi-Indicator Gauges
      • Multi-Indicator Graph
    • Action Plan Follow-up Reports
      • Action Plans (Dashboard)
        • Access path
        • Result
      • Action Plan Gantt Chart
  • GRC Solution Workflows
    • Risk Workflows
    • Testing Workflows
      • Test Plan/Audit Plan Workflow
      • Test Workflow
      • Test Activity Workflow
      • Expense Sheet Workflow
    • Action Plan Workflows
      • "Bottom-up" Action Plan Workflow
      • "Top-down" Action Plan Workflow
      • Action Workflow
    • Incident Workflow
    • Campaign Workflow
      • Assessment Campaign Workflow
      • Execution (Automatic) Campaign Workflow
  • The GRC Contributor Desktop
    • Presentation of the GRC Contributor Desktop
      • Accessing the GRC Contributor Desktop
      • Features Available to the GRC Contributor
      • Home Page
        • Dashboard
        • My Tasks
        • Environment
        • Risks
        • Controls
        • Incidents
    • Viewing your Environment
      • Processes
      • Applications
      • Business lines
      • Entities
    • Dashboard and Widgets
      • Widgets for Action Plans
      • GRC-specific widgets
      • Widgets specific HOPEX Internal Audit
    • Managing Incidents
      • Creating incidents
      • Accessing incidents
    • Managing Action Plans and Actions
      • Context for action plan creation
      • Accessing action plans
      • Connecting an issue to an action plan
      • Indicating action plan progress
      • Managing actions
    • Managing Recommendations
      • Accessing recommendations
      • Implementing recommendations
      • Viewing recommendation widgets
    • Managing Questionnaires and Check-lists
      • Accessing Questionnaires
      • Answering a Questionnaire
      • Completing Assessment Check-lists
    • Creating Risks and Controls
      • Creating risks
      • Creating controls
    • Managing Key Indicators
      • Accessing Key Indicators
      • Enter a key indicator value
      • Submitting an action plan on a key indicator
    • Performing a BIA (Business Impact Analysis)
    • Taking Part in Business Continuity Plans
      • Viewing BCPs tested by ongoing exercises
      • Viewing BCPs triggered by ongoing crises
  • Appendix - Computation Rules
    • Risk Control Level
      • Context
      • Computation method
      • Computation example
    • Inherent risk
      • Computation method
      • Possible values
    • Residual Risk
      • Computation method
      • Possible values
    • RTO (Recovery Time Objective) Computation
    • Business Impact Computation
  • GRC Glossary
• HOPEX Internal Control
  • About Control Management
    • Internal Control Process
      • Control register definition
      • Control Execution
      • Control Assessment
      • Issue and Action Plan Management
    • Control Management Profiles
  • Managing Controls
    • Creating Controls
    • Control Characteristics
      • General characteristics
        • Code
        • Key control
        • Status
        • Owner
        • Control nature
        • Execution mode
        • Operational cost
        • Description and Control objective
      • Control Overview
        • Identification
        • Dashboard
      • Responsibilities concerning Controls
        • Responsibility levels
        • Specifying control responsible users
      • Scope of a Control and Associated Risks
      • Regulatory and Business Policy Enforcement
      • Action Plans for Controls
      • Reports Related to Controls
    • Accessing Controls
      • Listing Controls
      • Accessing Orphan Controls
      • Accessing Controls by Incidents
    • Contextualizing Controls
  • Assessing Controls
    • Control Assessment Types
      • Direct Assessment or by Campaign
        • Direct assessment
        • Evaluation By Campaign
      • Available Assessment Templates
    • Pre-requisites to Control Assessment
      • Control Assessment by Entity
        • Assessment contexts
        • Prerequisites
        • Respondent definition logics
        • Specifying respondents
      • Control Assessment by Entity and Regulatory Framework
        • Assessment contexts
        • Prerequisites
        • Possible use
    • Control Direct Assessment
      • Direct Assessment Context
      • Assessing a Control
      • Assessing Multiple Controls Simultaneously
    • Assessment Control Results
      • Displaying the Results of Control Assessment
      • Analyzing Control Assessment Results
        • Instant reports
        • Dedicated analysis reports
      • Assessment Result Computing Mode
  • Executing Controls
    • Preparing Control Execution
      • Defining Questions on Controls
      • Defining Steering Calendars on Controls
        • Specifying a control steering calendar
        • Modifying a steering calendar after campaign creation
      • Defining the Total Population and Sample Size
      • Defining Respondents
      • Connecting Controls to Entity Processes
    • Continuous Control Assessment Template
      • Respondents
      • Check-lists sent
      • Answer computation
      • Aggregated results
    • Creating an Execution Campaign
      • Defining scope via a tree
      • Displaying the Execution Campaign Summary
        • General information (Overview)
        • Contexts
        • Respondents
        • Assessed objects
    • How an Execution Campaign Works
      • Control Execution Periodicity
      • Examples of Session Automatic Launch
      • Consulting Execution Campaign Schedule
      • Defining Reminders
        • Modifying reminders provided as standard
        • Deactivating reminders
      • Closing Check-lists
    • Completing Control Execution Check-Lists
      • Accessing Execution Check-Lists
      • Completing a Check-List
      • Transferring a Check-List
    • Managing Execution Check-Lists
      • Accessing Check-Lists
      • Reassigning Check-Lists
    • Check-List Results
    • Control Execution Reports
      • Consolidated Execution Results
        • Access path
        • Parameters
        • Result
      • Following Up Execution Sessions
        • Access path
        • Parameters
        • Result
  • Managing Compliance
    • About Unified Compliance Framework
      • Main UCF Concepts
        • Authority Documents
        • Citations
        • UCF Controls
        • Links between UCF concepts
        • Building a Shared List
      • Mapping between UCF and HOPEX Concepts
    • Managing the Regulatory Environment
      • Using UCF Import
        • UCF Import Prerequisites
        • Parameterizing UCF Import
        • Importing Data from the Common Controls Hub
      • Defining the Applicable Regulatory Content
        • Regulatory content relevance
        • Reviewing regulatory frameworks after UCF import
        • Selecting relevant content for your organization
    • Managing the Compliance Register
      • Concepts Used in the Compliance Register
      • Accessing the Elements of the Compliance Register
        • Displaying elements as a list
        • Displaying control directives in a tree of regulatory frameworks
        • Displaying business policies in a tree
      • Viewing Regulatory Frameworks
        • Accessing regulatory frameworks
        • Regulatory framework overview & description
        • Content of a regulatory framework
      • Viewing Regulation Articles
        • Accessing regulation articles
        • Connecting or viewing objects subjected to a regulation article
        • Enforcement of a regulatory article
        • Connecting Business Documents
      • Viewing Control Directives
        • Accessing control directives
        • Viewing articles associated to a control directive
        • Supported and supporting directives
        • Enforcement level of control directives
        • Viewing HOPEX controls implementing a control directive
        • Attaching business documents or external references
    • IT Regulatory Compliance Reports
      • Regulatory Compliance by Entity
        • Access path
        • Parameters and Launch
        • Example
      • Control Directives Implementation by Regulatory Framework
        • Access path
        • Parameters
        • Results
      • Compliance by Regulatory Framework
        • Access path
        • Parameters
        • Results
      • Regulatory Compliance Overview
        • Access path
        • Parameters
        • Results
      • Regulatory Compliance Progress
        • Access path
        • Parameters
        • Report example
  • Control Testing
    • Preparing Control Testing
      • Defining Test Sheet Questions
      • Defining Testing Methods
    • Preparing Tests
      • Creating Test Plans
      • Planning Tests
        • Creating a test
        • Accessing tests
        • Defining test properties
        • Viewing a test dashboard
        • Creating "template" tests
        • Selecting tests to be executed
        • Selecting tests to be integrated in the test plan
        • Planning tests using a Gantt chart
        • Assigning resources to tests
        • Sending the Notification Letter
        • Validating tests
        • Publishing tests
      • Preparing Tests
        • Work program creation prerequisites
        • Work program content
        • Creating work programs automatically
        • Completing the work program manually
        • Assigning activities
        • Reviewing the Work Program
        • Validating work programs
        • Executing administrative tasks
    • Executing Tests
      • Consulting the Work Program
      • Executing Tests on Samples
        • Creating workpapers
        • Specifying or modifying the sample size
        • Generating the test sample
        • Defining test sheet questions
        • Completing the generated test sheets
        • Assessing test activities
      • Assessing Controls
        • Generating questionnaires
        • Responding to Questionnaires
      • Managing Time and Expenses
        • Managing Expenses
        • Entering Vacations
        • Completing a Time Sheet
      • Management of issues and action plans
        • Managing issues
        • Managing Action Plans
      • Supervising Tests
        • Test check reports
        • Time Sheet Follow-up Reports
        • Test expenses reports
      • Concluding Tests
        • Test assessment reports
        • Generating test reports
        • Assessing tests
        • Terminating tests
        • Closing tests
    • Test Follow-Up
      • Implementing Action Plans
        • Accessing action plans
        • Implementing actions
        • Action plan implementation follow-up
      • Test Plan Follow-Up
        • Displaying test plan follow-up reports
        • Closing a test plan
      • Testing Dashboard
  • Managing Issues and Action Plans
    • Managing Issues
      • Creating Issues
      • Scoping an Issue
      • Remediating Issues
      • Following Up Issues
    • Managing Action Plans
      • Accessing Action Plans
      • Creating an Action Plan for Testing
      • Characterizing Action Plans
        • Overview
        • General characteristics
        • Responsibilities
        • Financial assertion
        • Success Factors and Outcome
        • Scope
        • Progress history
        • Milestones
        • Attachments
      • Managing Actions
        • Accessing actions
        • Creating actions
        • Describing action sequence flow
        • Reassigning actions
      • Action Plan Workflows
        • "Bottom-up" approach
        • "Top-down" approach
        • Action workflow
      • Indicating Action Plan Progress
      • Action Plan Follow-up Report (Dashboard)
        • Path
        • Result
  • Reports Related to Controls
    • Control Environment Report
      • Access path
      • Report parameters
      • Creating a control environment report
      • Example
    • Control Register Reports
      • Control Identification (Dashboard)
        • Path
        • Parameters
        • Results
        • Example
    • Control Execution Reports
      • Consolidated Execution Results
        • Access path
        • Parameters
        • Result
        • Example
      • Following Up Execution Sessions
        • Access path
        • Parameters
        • Result
    • Control Testing Reports
      • Testing Coverage
      • Plan Synthesis
        • Path
        • Result
        • Example
      • Other Reports
        • Test plan follow-up reports
        • Test follow-up report
        • Action plan report
    • Issue-Related Reports
      • Issues by Remediation Status
        • Path
        • Result
        • Example
      • Issues by Impact
        • Path
        • Result
• HOPEX Enterprise Risk Management
  • Managing Risks
    • Risk Management Profiles
    • Creating a Risk
    • Risk characteristics
      • General characteristics
      • Risk Overview
      • Risk Responsibilities (RACI)
      • Defining the Scope of a Risk
      • Analyzing Risks
        • Risk types
        • Risk Factors
        • Risk consequences
      • Viewing Audit Recommendations Connected to a Risk
    • Accessing Risks
      • Accessing All Risks
      • Accessing Orphan Risks
      • Accessing Materialized Risks
    • Risk Workflow
      • Risk validation steps
      • Validating or rejecting a risk
  • Assessing Risks
    • Risk Assessment Types
      • Direct Assessment or by Campaign
      • Available Assessment Templates
    • Prerequisites to Risk Assessment
      • “Risk Assessment by Entity and Process” Template
      • “Risk Assessment by Application” Template
    • Assessing Risks Directly
      • Direct Risk Assessment Templates
        • Assessed characteristics
        • Respondents
        • Questionnaire
      • Creating a Direct Assessment on a Risk
      • Assessing Multiple Risks Simultaneously
    • Viewing and Analyzing Risk Assessment Results
      • Displaying Risk Assessment Results
      • Generating Reports on Assessments
        • Instant reports
        • Generating dedicated reports
  • Risk Mitigation and Remediation
    • Mitigating Risks
      • Specifying the Risk-Mitigation Strategy
      • Specifying Risk Appetite
      • Implementing Controls
    • Remediating Risks
  • Risk-Related Reports
    • Risk Environment Report
      • Access path
      • Report parameters
      • Creating a Risk Environment Report
    • Bow-Tie Analysis
      • Access path
      • Example
    • Risk Profile Analysis by Context
      • Access path
      • Report parameters
      • Report content
      • Examples
    • Aggregation Reports
      • Residual Risk by Risk Type
        • Access path
        • Example
      • Inherent and Residual Risk Heatmap
        • Access path
        • Report parameters
        • Content of the heatmap
      • Inherent and Residual Risk Heatmap by Context
        • Access path
        • Report parameters
        • Report example
      • Risk Assessment by Context
        • Access path
        • Report parameters
        • Example
      • Overall Risk Level by Process Category
        • Access path
        • Report parameters
        • Report example
      • Overall Risk Level by Entity
        • Access path
        • Report parameters
        • Report example
      • Aggregation Report
        • Access path
        • Report parameters
        • Report example
    • Risk Follow-Up Reports
      • Action Plan Follow-up Report
        • Access path
        • Report parameters
        • Report example
      • Session Statistics Report
        • Access path
        • Parameters
        • Report example
        • Result
    • Risk Management Effectiveness Reports
      • Risk and Incident Analysis
        • Access path
        • Parameters
        • Report content
        • Example
      • Coverage & Risks Matrix
        • Access path
        • Matrix content
      • Risk Trend
        • Access path
        • Report parameters
        • Report example
        • Result computation
• HOPEX LDC
  • Collecting Incidents
    • Connection Profiles to HOPEX LDC
    • Managing Incidents
      • Accessing incidents
        • Filtering incidents
        • Accessing macro-incidents
      • Creating incidents
    • Specifying Incident Characteristics
    • Recording Incident-Linked Amounts
      • Accessing Incident Financial Analysis
      • Entering a Loss
      • Defining scope of a loss
      • Entering Gains
      • Recording Recoveries
      • Recording Provisions
      • Viewing Computed Amounts Related to the Incident
        • Gross Loss
        • Gross actual loss
        • Recoveries
        • Net Loss
        • Net Actual Loss
    • Analyzing Incidents
      • Incident Qualitative Analysis
        • Risks and controls
        • Incident priority
        • Incident Impact
        • Risk factors
        • Risk consequences
      • Incident scope
      • Incident Impact Analysis
    • Managing Macro-Incidents
      • Connecting Incidents to Macro-Incidents
      • Creating a Macro-Incident
      • Analyzing Macro-Incidents
        • Incidents connected to the macro-incident
        • Macro-incident amounts
        • Losses evolution report
    • Incident Management Process
      • Incident Management Process General Description
      • Incident Management Process Steps
        • Submitting incidents
        • Approving incidents
        • Validating incidents
        • Closing incidents
  • Reports Related to Incidents
    • Loss Analysis Reports
      • Incident and Loss Breakdown
        • Access path
        • Report parameters
        • Example
      • Incident and Loss Evolution by Month
        • Access path
        • Report parameters
        • Results
      • Incident and Loss Evolution by Risk Type
        • Access path
        • Report parameters
        • Results
    • Back Testing Reports
      • Losses by Risk (Back Testing)
        • Access path
        • Report parameters
        • Result
      • Incident X Risk Level by Risk Type (Back Testing)
        • Access path
        • Report parameters
        • Result
      • Incidents X Risk Level by Business Line (Back Testing)
        • Access path
        • Report parameters
        • Result
    • Capital Calculation Reports
      • Loss Distribution Matrix
        • Access path
        • Report parameters
        • Report
      • Basic Indicator Approach (BIA)
        • Access path
        • Report parameters
        • Result
      • Standardised Approach (TSA)
        • Access path
        • Report parameters
        • Result
• HOPEX Cyber Resilience
  • About HOPEX Cyber Resilience
    • Definition of Cyber Resilience
    • Context
    • Use together with other Solutions
  • Building Cyber Resilience
    • Steps in the Cyber Resilience Process
      • Managing the ICT Environment
      • Identifying Critical IT Processes and Resources
      • Assessing the Cyber Resilience Framework
      • Planning the Cyber Resilience Initiative
      • Managing Cyber-related Incidents
      • Monitoring Cyber Resilience
    • Managing ICT Vendors
      • Creating an ICT Vendor
      • Listing ICT Vendors
      • Assessing an ICT Vendor
      • Specifying Vendor Contracts
        • Creating a contract
        • Viewing the contract status
        • Specifying the contract characteristics
        • Attachments
    • Assessing ICT Risks
      • ICT Risk Assessment Template
        • Contexts
        • Respondents
        • Questionnaire rendering
      • Prerequisites to ICT Risk Assessment
      • Launching an ICT Risk Assessment
  • Cyber Resilience Reports
    • ICT Service Providers and Contracts
      • Access path
      • Illustration
      • Report parameters
      • Report content
      • Report example
    • Gantt of ICT Service Provider Contracts
      • Access path
      • Illustration
      • Report parameters
      • Report example
    • Incident Monitoring
      • Access path
      • Illustration
      • Report parameter
      • Report content
      • Report example
    • Incident Impacts
      • Access path
      • Illustration
      • Report parameter
      • Report content
      • Report example
    • Major Incident Report (MS-Word)
      • Access path
      • Illustration
      • Report content
        • Basic information on the incident
        • Detailed information
        • Causal analysis
        • Impacted elements
        • Financial assertion
    • Incident Bow-Tie Analysis
      • Access path
      • Illustration
      • Report Parameter
      • Report example
    • Process Impacts
      • Access path
      • Illustration
      • Report Parameter
      • Report example
    • Risk Dashboard by Risk Type
      • Access Path
      • Illustrations
      • Report Parameter
      • Dashboard Content
        • Residual risk level
        • Controls by control level
        • Residual risk heatmap
        • Incident heatmap by impact and priority
        • Evolutions of incidents over a year