HOPEX Aquila EN

GRC - Governance, Risk & Compliance > HOPEX GRC Common Features > GRC Environment Management > Organization > Managing Processes

Managing Processes

Two process levels are available:

• process category

A process category regroups several processes. It serves as a categorization level and provides access to finer grained processes.

• process

A process describes how to implement all or part of the process required to make a product or handle a flow.

Accessing processes

To access the process category / process tree:

In the navigation bar, select Processes.

The processes and process categories appear.

Process hierarchy

The hierarchy of processes/operations is as follows:

Process category > Process > Operation

For each process of the hierarchy the following is displayed:

• Risks (directly connected to processes)

• Controls (directly connected to risks, which are in turn connected to processes)

• Controls (directly connected to processes)

The following columns are available:

• Risks (number of)

• Controls (number of)

• Last assessment

• Residual risk

The residual (or net) risk indicates the risk to which the organization remains exposed after management has processed the risk.

• Forecast risk

Forecast risk represents the residual risk forecast for the year to come.

• Latest compliance rate

The compliance rate is the percentage of “Pass” controls.

• Control level

The Control level characterizes the efficiency level of control elements deployed (controls) to mitigate the risk.

Specifying process characteristics

To access the characteristics of a process:

Open the Characteristics page of the process properties.

The Owner is responsible for global operation of the process in terms of effectiveness, profitability and security.

Specifying process scope

A process can be linked to different objects types.

A specific page is available in the process properties for each object type:

• Risks: risks that relate to the process.

For more details, see Managing Risks.

• Controls: controls that relate to the process.

For more details, see Managing Controls.

• Incidents

• Action plans

To view regulations impacting a process, expand the Regulatory Impact section.

Specifying process responsibilities

Responsibilities on a process are shared by persons with different roles.

To specify responsibilities on a process:

In the process properties, expand the Responsibilities section.

You can specify the following responsibilities:

• Accountable

• Consulted

• Informed

The above responsibilities correspond to the RACI responsibilities. See Responsibilities (RACI).

• Risk assessor

The Risk assessor is responsible for assessing risks within his scope, as well as implementing action plans related to these risks.

You can define several risk assessors on the same entity.

• Control assessor

The Control assessor is responsible for assessing and executing controls within his/her scope, as well as implementing action plans related to these controls.

You can define several Control assessors on the same entity.

Specifying sub-processes

To specify the sub-categories of a process category:

In the process category properties, expand the Sub-processes section.

You can specify:

• The process category components

• The connected organizational processes

To specify the sub-processes of a process:

In the process properties, expand the Sub-processes and Operations section.

You can specify:

• sub-processes

• associated operations

Managing business continuity

These features are available with HOPEX BCM only.

To access the Business Impact Analyses (BIAs) and Business Continuity Plans (BCPs) associated to a a process category:

Open process category properties and select the Business Continuity page.

For more details, see:

• Defining a Business Impact Analysis

• Designing a Business Continuity Plan

To add a process category to a BCM system:

In a process category pop-up menu, select Add to BCM system.

For more details, see Managing BCM Systems.

To create a Business Impact Analysis (BIA) from a process category:

Right-click the process category and select Create a BIA.

Other sections of a process

The properties page of a process presents the following sections:

• Objectives: see Strategic Environment

• IT assets: It resources (applications, databases and servers) are made available for process implementation.

See Managing Applications.

• Entities that intervene in the process.

See Managing Entities.

• Business Lines: business lines that use the process services.

See Managing Business Lines.