Conducting a Risk Assessment - Starting a New Assessment Unit

Platform: Risk Assessment Platform

User Roles: End-user roles, such as Standard and Approver.

Assessment Units

The purpose of the assessment unit is to allow risk assessment to be performed in a hierarchical manner for a collection of different countries, operating groups, business divisions, functional areas, or product lines.

The Assessment Unit is where the detailed risk assessments occur, and the Assessment is the container that aggregates the results of all the assessment units.

For every Assessment, at least one Assessment Unit is required.

Assessment units are created within assessments from the Assessment Unit History page.

Assessment Unit History

The Assessment Unit History page details all of the assessment units that are in progress or published within the main assessment. This allows for an assessment of different countries, operating groups, business divisions, functional areas, product lines, or whatever other risk cross-section you choose.

The progress bar in the upper right indicates the overall progress toward completing the assessment unit's risks and controls by status.

The Action Menu () in the upper right contains options for the parent assessment. It provides options to run an assessment report, edit the assessment details, modify report groups, view the audit trail, export assessment data to CSV or Excel, and more.

Create custom report groups using the Weight column header. Define assessment units to include/exclude from the group, and their relative weightings, then save the grouping. Display that configuration by selecting the custom grouping in the Custom Report Group dropdown.

The Assessment Unit History Columns:

• Assessment Unit - Unique name for the assessment unit.
• Model - Risk model used for the assessment unit.
• Weight - The weight of the assessment unit in relation to other assessment units in the assessment. Select this column heading to adjust the weights and create custom weighting groups:
  • Exclude/include assessment units from the custom group
  • Change the order of assessment units
  • Change the weight of assessment units
  • Use Save As to give the custom group a name and create as many variations as needed.
  • Use Save to overwrite the default.
• Type - The type of assessment unit (based on the linked risk model)
  • Automatic - The inherent risk rating is calculated based on answers to questions by the assessor, where those answers are linked to ratings in the methodology. 
  • Manual - The inherent risk rating is calculated based on the risk likelihood and impact rating selected by the assessor, via a lookup against the methodology's inherent risk matrix. 
• Status - The status of the assessment unit will be either Not Started, In-Progress or Published.
• Start Date - Date the assessment unit was created.
• Publish Date - Date the assessment unit was published.
• Overall Residual Risk – The overall residual risk rating for the assessment unit.
• Status % - Completion % of risk factors across the assessment unit, by status.
• Actions - Resume, edit details, delete, audit, create assessment unit report, and export assessment unit data to CSV. If the assessment unit is published, users can unpublish or archive it.

Create an Assessment Unit

To create a new assessment unit, click the New Assessment Unit button.

In the New Assessment Unit popup window, complete the details:

• Name - Enter a name for the assessment unit.
• Start From - Optional; copy data from an existing assessment unit.
• Model - Select the risk model for the assessment unit.
  Note: the dropdown only displays risk models that use the same methodology as the assessment.
  
• Supporting Document Template - Optional; includes a checklist of supporting documents.
  Note: the dropdown only displays templates that use the same methodology as the assessment.
  
• Control Metric - Optional; remove the unselected metrics from the controls assessment.
• Owners - Optional; give restricted users access to the assessment unit.
  Note: Restricted users can be set as Owners before they activate their accounts.
  

The Assessment Unit consists of up to 5 parts:

• Context
• Supporting Docs (optional)
• Workflow
• Risk Analysis
• Controls Assessment
• Report

Assessment Unit Context

The assessment unit's Context page contains the same questions as the assessment context but should be completed in a manner relevant to the particular assessment unit's scope.

This page is not mandatory and can be left blank wholly or partially. Blank sections or fields will not appear in the assessment report.

There are two additional sections in the assessment unit context that will appear in the assessment unit report:

• Assessment Team - the name, title and email address of people involved in the assessment.
• Distribution List - the name, title and email address of people to receive the outputs.

Press the Next button or use the chevrons across the top to proceed to the next sections.