Conducting a Risk Assessment - Starting a New Risk Assessment

Platform: Risk Assessment

User roles: End-user roles, such as Standard and Approver.

Risk Assessment History

The Risk Assessment History screen lists all assessments that are in progress or published.

To set the Risk Assessment History page as the default home page, use the Home Page toggle.

The Risk Assessment History page can be set as your Home Page and accessed from the Home Page button on the header. Alternatively, open the To Do menu and select Risk Assessment History from the menu.

The Risk Assessment History page consists of:

• A New Assessment button to create new assessments.
• An Export button () to download an overview of all assessments.
• A Home Page toggle to change your default home page.
• The assessment table with details of the assessments and actions that can be performed on them.

Risk Assessment table columns:

• Assessment Name - The name for the assessment. It can be edited while in progress using the action menu () and selecting Assessment Details from the list.
• Methodology - The methodology used for the assessment and its assessment units.
• Status - The status of the assessment can be Not Started, In-Progress or Published.
• Start Date - Assessment created date.
• Publish Date - Assessment published date.
• Overall Residual Risk Rating – The aggregated residual risk from its assessment units.
• Status % -  Completion % of risk factors and controls across all its assessment units by status.
• Actions menu - The actions available are dependent on the status of the assessment:
  • In Progress - Resume, edit details, delete*, audit trail, create assessment report, modify report groups, or export assessment data to CSV.
  • Published - View, unpublish, or archive the assessment.

*Note: Assessments with Published or Archived assessment units cannot be deleted.

Create an Assessment

To create a new assessment, press the New Assessment button.

In the New Assessment popup window, complete the details:

• Methodology - Select the methodology to be used for the assessment.
  Note: This affects which risk models can be selected when creating assessment units.
• Name - Enter a name for the assessment
• Start From - Optional; copy data from an existing assessment.
• Country Risk Model - Select a country risk model for the assessment.
• Review periods
  • Period From - The date from which the assessment is being conducted
  • Period To - Date the assessment is due to be completed.
  • Next Review Date - If known, the date at which the assessment is due to be refreshed
    

Press the Create button to create the assessment.

The assessment consists of 3 parts:

• Context
• Assessment Unit
• Report

The chevrons at the upper left can be used to navigate to the different parts of the assessment.

The progress bar in the upper right indicates the overall progress toward completion of the risk factors and controls in the assessment units of the assessment.

The Action Menu () contains options to run an assessment report, edit the assessment details, delete it, modify report groups, view the audit trail, export assessment data to CSV or Excel, and more.

Assessment Context

The purpose of the assessment context is to describe the organisational context and background in relation to the review and to establish the nature, size, and complexity of the business being assessed.

Note: Enterprise-level assessments can be conducted with multiple assessment units, each representing a different region, country, operating group/division, product, employee role, etc.

This page is not mandatory and can be left blank wholly or partially. Blank sections or fields will not appear in the assessment report.

The Context page consists of three parts:

• Executive Summary
• Detailed Context
• Organisational Context

Use the Copy From if you wish to copy the context from an existing assessment or assessment unit.

Executive Summary

It is optional to provide this information:

• Background and Purpose - Capture the background to the assessment and the purpose or objectives of conducting the assessment.
• Overall Scope and Approach - Capture the scope of the assessment and the approach that will be undertaken to perform the assessment.
• Key Limitations and Assumptions - Capture any limitations encountered when performing the review or any assumptions that have been made.

Detailed Context

It is optional to provide this information:

• Detailed Scope – Capture a detailed scope of the assessment.
• Detailed Approach – Capture details of the methods used to gather and assess information.
• Detailed Limitations and Assumptions – Capture detailed information on the limitations and assumptions made that are relevant to the findings.

Organisational Context

It is optional to provide this information:

• Legal structure of the organisation - Legal entity type of organisation being assessed.
• Is the business part of a subsidiary of another entity - To determine the complexity of the business. applicable to major corporations and business conglomerates
• If yes, legal name of the group or parent entity - Mandatory if "Yes" is selected above. The registered name of the group or parent company.
• Country where the business is registered - Country where the business was first registered/incorporated.
• Country where the business is headquartered - Location of main headquarters by country.
• Number of outlets, branches or offices - To determine the complexity of business operations.
• Countries where the business operates - Countries, and percentage of the annual revenue derived from each country.
• Annual revenue - the size of the organisation by revenue.
• Number of employees - The size of the organisation by headcount, including part-time, full-time, and casual staff/contractors.
• Countries where the business uses third party distributors or agents - Countries, and percentage of the business/customers supported in each country.
• Approximate number of customers - To assess the complexity of the business by volume of customers.
• Countries where the business has customers - Countries, and percentage of customer base per country.
• Attachments - Links (URLs) or attachments can be uploaded as supporting material or evidence, such as organisational charts etc.

Press the Next button, or select the Assessment Unit chevron, to proceed to the next section.