Archiving

Archiving allows users to view previous evaluations. It is likely that external team members will be given read access to a restored version of this database for purposes of their internal control review. When a given entity (e.g. organization unit, process, IT Application, Project/Event) is archived, the entire RCM is archived; there is no ability to archive, for example, only the objectives. The following table shows by object what data is copied to an archive table when the archive is performed:

Archiving can be performed globally or selectively. Archiving risk and control analysis does NOT reset the status of evaluations, or clear any information related to risk and control analysis. Archiving takes a snapshot of the entire risk and control analysis for the entity including: overall RCM evaluation, objectives, risk event categories, risks, controls, tests, and checklists. This snapshot allows users to reference supporting information as of the point in time an evaluation was made. For example, to support the risk control adequacy evaluation as of a point in time, it may be important to note the ratings of control operating effectiveness as of that same point in time.

It is highly recommended that a backup of the database be taken at each period end.