Skip to main content

Add risks and controls

Create the risk and control objects your model needs and record the data that drives their risk values.

Prerequisites​

  • The PRC (Performance, Risk and Control) Module, and a license that can create PRC objects — see the License capability matrix.
  • Permission to add objects where you create them, and the Add Risk Data item role permission to enter risk data (Modify Risk Data to change existing data points).

Steps​

Add a Risk​

Risks can only be created in the Risk Catalog — at its root, in a risk folder, or under another Risk.

  1. In the repository tree, select the Risk Catalog (or the folder or Risk inside it that the new Risk belongs under).
  2. Select Add object at the top of the repository tree.
  3. In the Select Type step, choose Risk.
  4. Type a Name, and optionally a Summary.
  5. Choose a Risk Type. Your repository's list is maintained in Risk and Risk Instance configuration.
  6. Click Finish.

Add a Risk Instance​

Risk Instances can be created almost anywhere in the repository tree — usually under the process, activityActivity A named step in a process (e.g. "Approve Invoice"). Each event in an event log records one activity occurrence for one case., or other object that is at risk.

  1. Select the object the risk applies to.

  2. Select Add object, and in the Select Type step choose Risk Instance.

  3. Type a Name and choose a Risk Instance Type.

  4. Check the two relationship fields. What you created the instance under decides which one is already filled in:

    • Under an object a risk can apply to — a Process, ActivityActivity A named step in a process (e.g. "Approve Invoice"). Each event in an event log records one activity occurrence for one case., Journey, Capability, Resource, Requirement, diagram, and most other non-folder objects — Risk For names that object.
    • Under a catalog Risk, Associate with Risk names that Risk.

    For the other field, select Choose and pick the object the risk applies to, or the matching Risk from the Risk Catalog. Use Change to replace a filled-in value, or the trash icon to clear it.

  5. Click Finish.

You can also set or change both relationships later on the instance's Relationships tab — Risk For and Instance of Risk sit under the Performance, Risks, Opportunities and Controls group.

Add a Control​

Controls can only be created in the Controls branch — in a controls folder or under another Control.

  1. Select the Controls folder (or a folder or Control inside it).
  2. Select Add object, and in the Select Type step choose Control.
  3. Type a Name and choose a Control Type — for example Business Rule for an everyday rule, or Control for a mitigating control.
  4. Click Finish.
  5. On the new Control's Settings tab, set the Control Rating and Control Keying, and select the Risk Categories the control covers. Settings save as you change them.

Add a Control Instance​

  1. Select the object the control applies to. To mitigate a risk, create the Control Instance directly under the Risk or Risk Instance.

  2. Select Add object, and in the Select Type step choose Control Instance.

  3. Type a Name, then check the two relationship fields, which behave like a Risk Instance's:

    • Under an object a control can apply to — including a Risk or Risk Instance — Controls names that object, so creating the instance under the risk it mitigates wires up the relationship for you.
    • Under a catalog Control, Associate with Control names that Control.

    Select Choose to fill in the other field, Change to replace a value, or the trash icon to clear it.

  4. Click Finish, then set the rating, keying, and categories on the Settings tab as for a Control.

Record risk data​

For risks with the Standard data type:

  1. Open the Risk or Risk Instance and select the Data tab.
  2. In the entry row, pick a date, an Impact, and a Likelihood. The Value is derived from the repository's risk matrix as soon as both are set.
  3. Optionally set an Appetite, a Financial Impact, and a Reason.

The levels offered for Impact, Likelihood, and Appetite are your repository's own scales, set on the Risk Parameters tab of Risk and Risk Instance configuration — so the choices here, and the values the matrix derives from them, differ between repositories. 4. Click Add data point.

The Data tab of a Standard risk, with a saved data point deriving the value 12 - Medium from High impact and Medium likelihood.

Saved data points can be edited or deleted from the same table. You can date a data point in the future; it stays out of the current values until its date arrives.

For risks with the Internal Control System data type, see Work with ICS risk data instead.

Verify​

Open the object's main page. The Risk section shows the current inherent risk from your newest data point — and, once controls with ratings are related through Controlled By, the combined control value and the residual risk.