PVOR (as at 23rd May 2024)

Question 1

What are the key elements of PVOR?

Answer 1

1. Risk is anchored to business processes and complements the current approach of identifying where risk impacts
2. New Control Assessment to help each business understand the coverage, effectiveness, and efficiency of their control environment against risks
3. New Critical Operation Risk Profiles (CPS 230)

Question 2

What are the benefits of PVOR, broadly?

Answer 2

• Clear
• Complete
• Efficient

Question 3

In terms of PVOR benefits, what do we mean by Clear?

Answer 3

• Risk anchored to Process
• IRA removed
• All MRE are considered with explicit rationale if excluded

Question 4

In terms of PVOR benefits, what do we mean by Complete?

Answer 4

• Consistent data points provided (via GRACE) to support risk assessments
• Prescriptive control assessment
• Clear target risk and response

Question 5

In terms of PVOR benefits, what do we mean by Efficient?

Answer 5

• Automated calculation of risk response
• Automated MRE-level risk profile (with override)
• Visualisation of risk profile for efficient reporting

Question 6

What is type of Risk Profiling is the focus of Release 1?

Answer 6

CO Risk Profiles

Question 7

What is type of Risk Profiling is the focus of Release 2?

Answer 7

Divisional Risk Profiles

Question 8

When is PVOR Release 1?

Answer 8

28th June

Question 9

What ‘Features’ are being released in PVOR R1 (28th June)?

Answer 9

1. Risk Profiling methodology + template
2. CCA methodology + worksheets
3. Guidance notes for RP and CCA (supporting R1 + R2)
4. ELearn (including video) (supporting R1 + R2)

Question 10

When will PACE 2.0 soft launch be?

Answer 10

12th August

Question 11

When will CO Risk Profiles be worked on?

Answer 11

July – September

Question 12

When will Divisional Risk Profiles be worked on?

Answer 12

FY25 (October onwards)

Question 13

When is PVOR Release 2?

Answer 13

September 16

Question 14

When will CCA hard launch be?

Answer 14

After September, in FY25

Question 15

What should colleagues do to prepare for CCA hard launch (not a ‘must do’)?

Answer 15

Delink unrelated controls from Risks (and other linkage clean up as required).

Question 16

Once CCA is hard launched, what will colleagues be required to do (‘must do’)?

Answer 16

Uplift environment to meet new metrics

Question 17

After PACE 2.0 soft launch, should people do PACE work before the hard launch?

Answer 17

Not recommended – focus on learning new methodology

Question 18

What is recommended (‘should do’) for preparing for tech release?

Answer 18

• Fix ineffective controls
• Review & republish models
• Review obligation linkages (‘could do’)
• Review evidence controls (TBD) (‘could do’)

Question 19

Will new evidentiary controls be released after PVOR Release 2?

Answer 19

No

Question 20

What CO features will only be delivered to ECP/Risk colleagues supporting CO Risk Profiles?

Answer 20

• RP template
• CCA worksheets
• Guidance Notes