Platform: Risk Assessment Platform
Applies to: User roles; e.g. Standard and Approver.
The purpose of the assessment unit is to allow the risk assessment to be performed for a collection of different countries, operating groups, business divisions, functional areas or product lines in a hierarchical manner.
The assessment unit is where the detailed risk assessments occur and the Risk Assessment is the container that aggregates the results of all the assessment units.
For every Assessment, at least one Assessment Unit is required.
Assessment units are created within assessments, from the Assessment Unit History page.
Assessment Unit History
The Assessment Unit History page details all of the assessment units that are in progress or published within the main assessment. The purpose of this is to allow an assessment of different countries, operating groups, business divisions, functional areas or product lines (or whatever other risk cross-section you choose) to be assessed in a hierarchical manner.
The progress bar in the upper right indicates the overall progress toward completion of the assessment unit's risks and controls, by status.
The Action Menu () in the upper right contains options to run an assessment report, configure the assessment report, edit details of the assessment, modify custom weighting groups, view the audit trail, export assessment data to CSV or Excel, and more.
Create custom weighting groups using the Weight column header. Define assessment units to include/exclude from the group, and their relative weightings, then save the grouping. Display that configuration by selecting the custom grouping in the Custom Weighting Group dropdown.
The Assessment Unit History Columns:
- Assessment Unit - Unique name for the assessment unit.
- Model - Risk model used for the assessment unit.
- Weight - The weight of the assessment unit in relation to other assessment units in the assessment. Select this column heading to adjust the weights and create custom weighting groups:
- Exclude/include assessment units from the custom group
- Change the order of assessment units
- Change the weight of assessment units
- Use Save As to give the custom group a name and create as many variations as needed.
- Use Save to overwrite the default.
- Type - The type of assessment unit (based on the linked risk model)
- Automatic - The inherent risk rating is calculated based on answers to questions by the assessor, where those answers are linked to ratings in the methodology.
- Manual - The inherent risk rating is calculated based on the risk likelihood and impact rating selected by the assessor, via a lookup against the methodology's inherent risk matrix.
- Status - The status of the assessment unit will be either Not Started, In-Progress or Published.
- Start Date - Date the assessment unit was created.
- Publish Date - Date the assessment unit was published.
- Overall Residual Risk – The overall residual risk rating for the assessment unit.
- Status % - Completion % of risk factors across the assessment unit, by status.
- Actions - Resume, edit details, delete, audit, create assessment unit report, and export assessment unit data to CSV. If the assessment unit is published, users can unpublish or archive it.
Create an Assessment Unit
To create a new assessment unit, click the New Assessment Unit button.
In the New Assessment Unit popup window, complete the details:
- Name - Enter a name for the assessment unit.
- Start From - Optional, to copy data from an existing assessment unit.
- Model - Select the risk model for the assessment unit.
Note: the dropdown only displays risk models that use the same methodology as the assessment.
- Supporting Document Template - Optional, to include a checklist of supporting documents.
Note: the dropdown only displays templates that use the same methodology as the assessment.
- Control Metric - Optional, to remove the unselected metrics from the controls assessment.
- Owners - Optional, to give restricted users access to the assessment unit.
Note: Restricted users can be set as Owners before they activate their accounts.
The Assessment Unit consists of up to 5 parts:
Assessment Unit Context
The Context page of the assessment unit contains the same questions as the assessment context but should be completed relevant to the scope of the particular assessment unit.
This page is not mandatory and, if preferred, can be left blank wholly or partially. Blank sections or fields will not appear in the assessment report.
There are two additional sections in the assessment unit context that will appear in the appendix of the assessment unit report:
- Assessment Team - the name, title and email address of people involved in the assessment.
- Distribution List - the name, title and email address of people to receive the outputs.