Risk Implementation Approach Flashcards
Risk Record & Risk Framework - lifecycle and role to create
active - inactive
Risk manager or above
Risk Lifecycle
Draft Assess Respond Review Monitor Retired
Who can create a risk
Risk User
Who performs risk assessment
Risk Owner
Who can move risk into monitor
Risk Manager
Who can retire a risk
Risk Manager
Risk Response Lifecycle
Draft
Work in Progress
Review
Closed
if it is an “accepted” risk (not mitigate, avoid, transfer) “awaiting approval” state is included after WiP
Who/How are Risk Responses generated
Automatically when risk is in “respond” state
or by Risk User
Who can be assigned Risk Response
Risk User
Who can assign Risk Response
Risk Manager
Who can close Risk Response
Assigned Risk User
or grc_manager
Primary Risk Relationship
Risk Framework Risk Statement Risk
RF–>RS =m2m, RS–>RF=0to1, RS–>Risk=m2m, Risk–>RS= NotSpecified?(P.188
**Recommend studying page 189
**recommend studying page 189
Indicator template - name and scope
sn_grc_indicator_template
GRC: Profiles
Indicator - name and scope
sn_grc_indicator
GRC: Profiles
Risk Statement - name and scope
sn_risk_definition
GRC: Risk
Risk - name
sn_risk_risk
GRC: Risk
Entity Type - name and scope
sn_grc_profile_type
GRC: Profiles
Entity - name and scope
sn_grc_profile
GRC: Profile
Issue - name and scope
sn_grc_issue
GRC: Profiles
Risk Assessment - name an scope
asmt_metric_type
GRC: Risk
Risk Response Task - name and scope
sn_risk_response_task
GRC: Risk
Controls - name and scope
sn_compliance_control
GRC: Policy and Compliance
Risk Event - name and scope
sn_risk_advanced_event
GRC: Risk
Risk to Control table name
sn_risk_m2m_risk_control
Entity Type to Risk Statement table name
sn_risk_m2m_risk_definition_policy_statement
Risk Framework to Entity Type
sn_risk_m2m_framework_profile_type
Modify the calculations of multiple risks on an entity
RiskUtils
Add additional calculations to risks
RiskALECalculator
Change the relationship behavior between a Control and a Risk
Mitigation Controls
Change the states and behaviors of risk mitigation
RiskResponse
Modify how Risks are generated and associated to entitties
RiskGeneratorStrategy
Adjust the colors and display settings when creating a risk heat map
RiskHeatMap
Risk Assessment Methods
Quantitative (SLE & ARO) (default)
Qualitative (Impact & Likelihood)
4 components of a risk score
[SLE/Impact]
[ARO/Likelihood]
ALE (Annualized Loss Expectancy)
Score
Scoring Types
Inherent
Calculated
Residual
SLE * ARO =
Inherent ($18M60%=)
Residual ($6M40%=)
= ALE
Inherent (=$10.8M)
Residual (=$2.4M)
Regardless of Quant vs. Qual. ALE will….
always be the same
Where to change risk criteria
Risk Criteria Matrix
Risk > Administration > Risk Criteria
Impact: 1 - very low 2 - low 3 - moderate 4 - high 5 - very high (what are default currency values)
$1M $5M $10M $20M $25M
Likelihood: 1 - extremely unlikely 2 - unlikely 3 - neutral 4 - likely 5 - extremely likely (what are default percentages)
20% 40% 60% 80% 100%
Score: 1 - very low 2 - low 3 - moderate 4 - high 5 - very high (what are currency values)
$1M $5M $10M $20M $25M
What is Control Failure Facture
impact of control failures on calculated score
%=(weight of non-compliant controls)/(weight of all controls)
Indicator Failure Factor
Impact of risk indicator failures on the calculated score of risks
%=(failed risk indicators)/(all risk indicators)
Calculated risk factor
represents the average impact factor that is used to compute calculated score or risk
%(CFF+IFF)/2
(if IFF is null, CRF will not calculate)
Calculated ALE
residual ALE + [(inherent ALE - residual ALE)*(CRF/100)]
Biggest benefit of Advanced Risk
rollup/hierarchy
reporting
Different Risk Assessment with Advanced Risk
Operational Assessment
Application Assessment
Project Assessment
3 assessment types that can be included in Risk Assessment Methodology (RAM)
Inherent
Control Effectiveness
Residual Risk
Service Portal Customization
Separate portal for risk and compliance
add approvals
add task management
import options
import into risk framework & statement tables
Risk Framework Form customizations
Add fields - importing owner/owning group reviewers approvers valid from/valid to
Risk Statement form customizations
Add fields - imported order classification (need choices) type (need choices) active flag
Risk form customizations
add fields - created manually
type
status (not assessed, acceptable warning, exceeds tolerance)
Risk Response Tasks form customization
Add fields - work notes list, watch list
assignment group
due date
Tables extending rom Risk Response Tasks
Risk Acceptance Task
Risk Avoidance Task
Risk Mitigation Task
Risk Transfer Task
