Add and Manage Risks

Within the Risk Control Matrix, you can add and manage risks that could impact specific objectives. Once the list of risks is created, then complete the risk evaluation, link existing and new objectives, and add controls to the risk.

1. Access the Entity Hierarchy
   1. Select the Default GRC context from the context menu.
   2. Click the GRC Register tab.
   3. Select Entity Hierarchy from the Frameworks group.

      

2. Add Risks
   1. Right click on the RCM where you wish to add the object, click Add Object and select Risk.

      OR

   2. Double-click the RCM you wish to view or right-click and select View Object. The RCM page will appear in the window on the right-hand side of the screen.
   3. Click Expand to view the Risks section.
   4. Click Add in the Risks section to link risks to this process through in-line editing or click Add to open the Risk form in a separate window.

      In Line View

      

      Risk Form

      

   5. Enter a Risk Name and description.

      Note: Do not utilize the following characters when entering information into Portal; & * % # @ ; / \ : , - or ~. .

   6. Select a Significance from the drop-down list.
   7. Select a Date Reviewed.

      Note: This field is only applicable if ORM-RCSA has been licensed.

   8. Click Save.

      Notes: Risk Names are required to be unique. The Risks are added to the Risk List. Once the risk as been submitted, the Risk Evaluation section can be completed. Administrators can configure fields in the Risk form to update a field based on a specific value of another field or fields. See Configure a Calculated Field for details.

3. Complete the Risk Evaluation via in line editing
   1. Double-click the RCM for the entity, or right-click and select View Object.
   2. Scroll to the Risks section and click Edit next to the name of the risk you wish to evaluate.

      Note: Click Edit All to place all listed risks in edit mode at the same time.

      

   3. Select the risk control design effectiveness and risk control adequacy evaluations from the drop-down lists.
   4. Update any additional information that is displayed as necessary.
   5. Click Save.

      Note: Click Save All if the Edit All functionality was utilized.

   Note: Some fields may already be populated using a conditional calculation created by an administrator. Contact your project lead for information on how the field is calculated. See Calculated Fields on how this functionality works.

4. Complete the Risk Evaluation via the Risk Evaluation Form
   1. Expand the Risk folder in the RCM for the selected entity.
   2. Double-click the risk you wish to edit, or right-click and select View Object.

      Notes: You can also access the risk from the RCM form. Double-click the RCM or right-click and and select View Object. Click the name of the risk you wish to evaluate from the risk list. Users may see different versions of the Risk Evaluation section depending on their role. For more information, see Manage Tabs and Module Groups.

   3. Select the control design effectiveness and control adequacy from the drop-down list.

      Note: It is likely that your design effectiveness and control adequacy evaluations will come after assessment of a group of controls and not when you are entering the risk for the first time.

   4. Click Select User or Select User Group to enter the name of the evaluator. There are three options to assist in locating the evaluator name:
      • Enter text that contains the name, email address or network ID of the user you wish to select and click Execute or click Show All.

        Note: A list of users containing, (not equaling), the entered text will display in the search results.

      • Click the name of the user or click Select No User to indicate the user is not required.
   5. Enter any comments.
   6. Select a status, review status and period end date from the drop-down list.

      Note: The Risk Evaluation information may be updated at a later time by selecting Edit beside the risk to be edited on the Process Objective form.

   7. Click Save.

   Note: Some fields may already be populated using a conditional calculation created by an administrator. Contact your project lead for information on how the field is calculated. See Calculated Fields on how this functionality works.

5. Link Existing Objectives, Controls, and Dependent Controls to Risks

   You have the option of linking the objectives affected by the risk, the controls related to the risk, or dependent controls, which are controls owned by different entities that are relied upon to mitigate risks within the entity being analyzed.

   1. Right-click on the risk that you wish to link from the entity hierarchy, click Link Object and select Objective, Control, or Dependent Control, depending on which object you wish to link.

      Note: You can also link risks, controls and dependent controls from the Risk form.

      1. Double-click the Risk or right-click and select View Object. The Risk form will appear in the window on the right-hand side of the screen.
      2. Click Link in the Objective, Controls or Dependent Controls section, depending on which object type you wish to link.
   2. Mark the checkboxes next to the objectives, controls or dependent controls you wish to link from the list, depending on your initial selection.

      Note: Click Edit Search and utilize the list search functionality to modify your selection and focus your results. Utilize List Searches for more information.

   3. Click Save.
6. Add New Objectives or Controls to Risks

   New objectives and/or controls can be linked to a given risk.

   1. Right-click on the risk where you wish to link a new object, click Add Object and select Objective or Control depending on which object you wish to add.

      Note: You can also add risks and controls from the Risk form.

      1. Double-click the risk or right-click and select View Object. The Risk form will appear in the window on the right-hand side of the screen.
      2. Click Add in the Risks or Controls section, depending on which object type you wish to add.
   2. Fill out the object form and click Save. The new object will be added to the RCM and linked to the risk from which it was added.

   Note: See Add and Manage Objectives and Add and Manage Controls for more information on filling out the forms for the specific objects.

7. Risk Quick Reports

   See Quick Reports for additional information on generating, adding, editing and deleting Risk Quick Reports.

   Note: The Quick Reports link will not appear on the Risk forms unless they have been configured to do so. For information on adding the Quick Report link to the form, see Configure a form.

Note: Administrators can configure fields in the Risk form to update a field based on a specific value of another field or fields. See Configure a Calculated Field for details.