PACE PMR SOP Flashcards

1
Q

What is PACE?

A

Enterprise methodology for documenting business processes and designing controls with a view of obligations and business/customer outcomes whilst reflecting the risks in the processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Do process models developed using PACE provide a powerful tool for understanding our processes and identifying opportunities and gaps?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the 7 main steps of PACE?

A
  1. Identify and engage key stakeholders
  2. Document the process
  3. Establish process objective
  4. Analyse controls and confirm linkages
  5. Create GRACE records for control gaps
  6. Overlay controls and publish models
  7. Maintain PACE certified models
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the 3 prerequisites that must be met prior to commencing PACE work?

A
  1. PACE Coach assigned
  2. Process scope confirmed (by PO/PMO)
  3. Key stakeholders engaged
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Who are the 5 main parties involved in PMR activities?

A
  1. Process Owner (PO)
  2. Process Model Owner (PMO)
  3. Risk/Obligation/Control Owner/Manager
  4. DCO
  5. PACE Coach and PACE SMEs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Who is the first point of contact before a Risk or Obligation Owner/Manager is consulted?

A

DCO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

True or False: DCO is the first point of contact before the Risk or Obligation Owner/Manager is consulted?

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

In the PMR, what are Process Owner (PO) tasks?

A

Accountable for signing off on process models/objectives and ensuring the correct controls are overlayed to the process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

In the PMR, what are Process Model Owner (PMO) tasks?

A

Generally doing and overseeing the work that will be signed off by the PO (includes responsibility for documenting/updating models and objectives).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

In the PMR, what are Risk Owner/Manager tasks?

A

Consulted regarding controls in general (those existing, required, and gaps) and accountable/responsible for confirming the risks to be linked to the identified controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

In the PMR, what are Obligation Owner/Manager tasks?

A
  • Accountable/Responsible for confirming obligations relevant to the Process Objective, and:
  • Consulted regarding controls in general (those existing, required, and gaps) and accountable/responsible for confirming the obligations to be linked to the identified controls.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

In the PMR, what are Control Owner/Manager tasks?

A

Accountable/Responsible for analysing controls and identifying gaps/deficiencies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

In the PMR, what are DCO tasks?

A

Consulted for everything except documenting models; first point of contact before Risk/Obligation Owner/Manager is consulted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

In the PMR, what are PACE Process SME tasks?

A
  • Update models and objectives, overlay controls, submit models for publishing.
  • Refer to DCO / Obligation SMEs to confirm obligations relevant to the process.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

In the PMR, who is responsible for updating models/objectives, overlaying controls, and submitting models for publishing?

A

PACE Process SME

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

In the PMR, what are PACE Control SME tasks?

A

Identify and analyse controls in the process and confirm obligations/risks to be linked to controls with DCO/Obligation/Risk SMEs.

17
Q

In the PMR, what are PACE Coach tasks?

A

Oversee all activities and certify models

18
Q

Who are the key stakeholders in documenting Level 4 Process Models?

A
  1. PO/PMO
  2. DCO Partner
  3. Business SMEs
  4. PACE Coach/SMEs
19
Q

For swimlanes, what is the bare minimum number of levels of hierarchy?

A

3

20
Q

What is the new swimlane hierarchy?

A

Group CEO > Division > Sub Division > Business Unit > Team > Role (minimum of 3)

21
Q

What 2 new things must be considered when documenting a process model?

A
  1. Whether the process supports a Critical Operation
  2. Whether any part of the process is subject to Continuous Monitoring
22
Q

In which folder must process models be documented in?

A

The Correct Process Hub BAU folder.
Do NOT use NAB Process Catalogue A-Z folders or the Drafted_Revisions folder to create or update process models!

23
Q

What 3 things must be included in the Process Objective?

A
  1. Business Objectives (why the process exists and expected outcomes).
  2. Obligations (only included if the process is designed to specifically meet element/s of the obligation that can be defined, and the obligation can be linked to a control embedded in the process, and the control does not have other obligations linked to it in GRACE).
  3. Continuous Monitoring, if applicable (must note the specific part/s of the Process Objective being monitored and the relevant GRACE Indicator IDs).
24
Q

When can you include Obligations in the Process Objective?

A
  1. Process is designed to meet specific element(s) of the obligation(s).
  2. The element(s) of the obligation(s) can be specifically defined.
  3. The obligation can be linked to a control that is embedded in the process, and that control does not have other obligations linked to it in GRACE*.

*The Obligation Owner/Manager determines the linkages to controls. If there are multiple obligations linked to a control, engage the DCO and/or the relevant Obligation Managers and Process Owner to confirm the applicability of obligations that are linked to the controls that are operating in the process.

25
Q

Why is the Process Objective considered a critical anchor point?

A

It helps the Process Owner determine whether the process has the right controls in place to achieve intended business and/or customer outcomes.

26
Q

Who are the key stakeholders for establishing/updating the Process Objective?

A
  • PO/PMO
  • Obligation/Control Owner/Manager
  • DCO Partner
  • PACE Coach/SMEs
  • Business SMEs who operate the process.
27
Q

What are the steps for establishing Process Objective?

A
  1. PACE engage DCO to obtain context of the process/obligations and tell who the Obligation Manager(s) to be consulted are.
  2. PACE SME requires Obligation Manager(s) to confirm the obligations DCO say are required.
  3. PACE SME meets with business stakeholders to walk through the process, document and confirm process objective.
28
Q

What is the purpose of step 4 ‘Analyse Controls and Confirm Linkages’?

A
  1. Determine the controls that are, or should be, operating in the process.
  2. Analyse control objecitves/operation individually and collectively to ensure alignment and support of the Process Objective.
  3. Obtain confirmation of the required linkages to the controls in GRACE.
29
Q

What are the five steps in step 4 ‘Analyse Controls and Confirm Linkages’?

A
  1. Work with Business SMEs to determine required controls.
    2a. Confirm controls with Control Owner/PO/PMO.
    2b. For undocumented controls - request Control Owner or Process Owner to create a new control record in GRACE so the new (draft) control can be overlayed to the model and analysed.
  2. Analyse controls (individually and collectively, including drafts) to ensure alignment with process objective.
  3. Report control deficiencies/gaps/misalignment to Control Owner/Manager to raise a GRACE Finding, remove the control, or address the control gap.
  4. Obtain confirmation for linkages of obligations and/or risks to controls (first contact DCO or equivalent to learn who to contact)
30
Q

What should PACE do if an undocumented control is identified?

A

Request Control Owner or Process Owner to create a new control record in GRACE so the new (draft) control can be overlayed to the model and analysed.

31
Q

Who should control misalignments, gaps, or deficiencies be reported to?

A

Control Owner/Manager

32
Q

When control misalignments, gaps, or deficiencies are reported to a Control Owner/Manager, what should the Control Owner/Manager do?

A

Raise a GRACE finding, remove the control, or address the misalignment/gap/deficiency.

33
Q

When does inferred overlay of obligations and/or risks linked to controls overlayed to processes occur?

A

AFTER the model has been PACE certified and BEFORE the process model is approved by the PO/PMO.

34
Q

What does PACE certification indicate?

A

The process has been documented using the PACE methodology and has been over sighted by a PACE Coach.

35
Q

Can draft controls be overlayed to process models?

A

Yes, they must be.

36
Q

How long do PACE Coaches, POs, and PMOs have to approve PACE model approval tasks once received?

A

3 days (otherwise the model will be rejected from the approval workflow)

37
Q

Once a model is published, what must be done for draft controls?

A

The modeler who submitted the publishing request must notify the Control Owner/Manager that the draft control may be activated in GRACE.

38
Q

What are the 4 steps of maintaining PACE certified models (when a relevant trigger indicates the requirement of re-certification)?

A
  1. Identify the model to be updated and the type of change required (based on the trigger event).
  2. Understand the impact of the change on the Process Objective and engage others as required.
  3. Review the process design, controls, and linkages to validate/update as required (obtain confirmation from DCO/Obligation/Risk as required).
  4. Update the PACE certified model and republish
39
Q

What 3 things can no longer be overlayed at a task level

A

Controls, Obligation Instances, and Risks (they must be overlayed at the Diagram level).