HOPEX Aquila EN

GRC - Governance, Risk & Compliance > HOPEX LDC > Collecting Incidents > Recording Incident-Linked Amounts > Defining scope of a loss

Defining scope of a loss

Scope of a loss enables definition of location of the loss, the associated incident and therefore a risk within the organization.

Organization description is detailed in chapter GRC Environment Management.

The scope is specified on several component types:

• entities concerned by the loss

An entity can be internal or external to the enterprise: an entity represents an organizational element of enterprise structure such as a management, department, or job function. It is defined at a level depending on the degree of detail to be provided on the organization (see org-unit type). Example: financial management, sales management, marketing department, account manager. An external entity represents an organization that exchanges flows with the enterprise, Example: customer, supplier, government office.

• business lines concerned by the loss

A business line is a skill or grouping of skills of interest for the enterprise. It corresponds for example to major product segments, to distribution channels or to business activities.

• risk types to be associated with the loss

A risk type defines a risk typology standardized within the context of an organization.

• business processes andorganizational processes concerned by the loss

A process category regroups several processes. It serves as a categorization level and provides access to finer grained processes.

A process describes how to implement all or part of the process required to make a product or handle a flow.

• products impacted by the loss

A product represents commodities offered for sale, either goods or merchandise produced as the result of manufacturing, or a service, ie. work done by one person or group that benefits another.

• applications impacted by the loss

An application is a set of software tools coherent from a software development viewpoint.