|
|
| (4 intermediate revisions by the same user not shown) |
| Line 2: |
Line 2: |
| | = ICM Risk Management App = | | = ICM Risk Management App = |
| | | | |
| − | == Overview == | + | == == |
| − | | + | |
| − | The Icertis (ICM) platform introduces the Risk Management application to make it easier for professionals to carry out their tasks related to Risk Management such as assessment, due diligence, remediation, monitoring and reassessment. Risk Management is the process of identifying the potential risk, assessing the magnitude of the risk based on business objectives and devising strategies to mitigate them and tracking the performance until they are completely mitigated. <br/> It enables secure communication with different parties involved in the process of Risk Management that is more effective than the traditional ways of communication such as email. Its user-friendly interface makes it possible for anyone in the enterprise, from the risk management personnel to the supply analytics team, to be able to use the platform with ease. <br/> ICM Risk Management consists of:
| + | |
| − | | + | |
| − | *Risk assessment (with survey)
| + | |
| − | *Auto instantiation of risk area
| + | |
| − | *Configurable contract types risk assessment and risk area with its workflow based on risk management process
| + | |
| − | *Masterdata that captures risk library, risk taxonomy and risk score matrix to effectively govern the risk management process
| + | |
| − | | + | |
| − | screen 1
| + | |
| − | | + | |
| − | ICM Risk Management application is based on the ICM platform that supports the following business scenarios:
| + | |
| − | | + | |
| − | *Contractual Risk Management
| + | |
| − | *Counter Party Risk Management (for example managing risks relevant to suppliers or vendors)
| + | |
| − | *Business Operations Level Risk Management
| + | |
| − | | + | |
| − | == The Prerequisites == | + | |
| − | | + | |
| − | The user must have:
| + | |
| − | | + | |
| − | *Completed ICM Product Training
| + | |
| − | *Risk Management App must be enabled on customer environment
| + | |
| − | | + | |
| − | == Configuration setup overview ==
| + | |
| − | | + | |
| − | ICM offers the ability to determine the application type (Contracting, Sourcing, Obligation Management and Risk Management application) when creating a contract type. This is possible with the inclusion of two new choice type attributes, Business Application Type and Business Application Category at the contract type level. This feature helps effortlessly drive business applications on ICM platform.<br/> These attributes are enabled through technical configuration and applicable for agreements and associated document contract types. The access privileges for business applications (such as Risk Management) are managed through security groups. <br/> screen2
| + | |
| − | | + | |
| − | The Risk Management Application provides some seeded entities that are necessary for the flow of the Risk Management. Some of the entities are:
| + | |
| − | | + | |
| − | *Masterdata:
| + | |
| − | **Risk Taxonomy
| + | |
| − | **Risk Remediation
| + | |
| − | **Risk Area Master
| + | |
| − | **Likelihood Rating
| + | |
| − | **Likelihood & Consequence Rating
| + | |
| − | **Risk Score Matrix
| + | |
| − | *Contract types:
| + | |
| − | **Risk Assessment as agreement contract type with business application type as risk management and business application category as risk assessment defined at contract type level
| + | |
| − | **Risk Area as associated document contract type with business application type as risk management and business application category as risk area defined at contract type level
| + | |
| − | *Rules:
| + | |
| − | **Instantiate the risk areas after completing the risk assessment
| + | |
| − | **Copy attribute values from risk assessment to the risk area
| + | |
| − | **Add risk area owner to the team
| + | |
| − | **Add Approver
| + | |
| − | **Add Team members
| + | |
| − | **Select the Template
| + | |
| − | *Notifications for events:
| + | |
| − | **Risk area is created
| + | |
| − | **Risk area due diligence is initiated
| + | |
| − | **Risk area remediation is initiated
| + | |
| − | **Risk area monitoring is initiated
| + | |
| − | **Risk area is deactivated
| + | |
| − | | + | |
| − | Please refer to the Risk Management Configuration guide for details.<br/>
| + | |
| − | | + | |
| − | == Setting up masterdata values ==
| + | |
| − | | + | |
| − | Risk Management Application provides some seeded masterdata that are necessary for the flow of the Risk Management. Users can create masterdata instances with desired values.<br/> To create masterdata instance:
| + | |
| − | | + | |
| − | #Click Configuration > Masterdata > Create Masterdata on the Home page. The Create Masterdata page opens.
| + | |
| − | | + | |
| − | Screen 3
| + | |
| − | <ol start="2">
| + | |
| − | <li>Select the Masterdata Contract Type. For example, Risk Area Master.</li>
| + | |
| − | </ol>
| + | |
| − | | + | |
| − | Screen 4
| + | |
| − | <ol start="3">
| + | |
| − | <li>Click Next. The Attributes page opens.</li>
| + | |
| − | <li>Enter or select the details in the fields.</li>
| + | |
| − | <li>Click Save. The masterdata instance is created.</li>
| + | |
| − | </ol>
| + | |
| − | | + | |
| − | screen 5
| + | |
| − | | + | |
| − | Similarly, setup masterdata for Risk Taxonomy, Risk Remediation action, Risk Area, Likelihood Rating, Likelihood & Consequence Rating, Risk Score Matrix Masters.
| + | |
| − | | + | |
| − | == Working with Risk Assessment ==
| + | |
| − | | + | |
| − | The Icertis Risk Management app enables users to manage risks by creating risk assessment. Risk Assessment deals with the process of identifying and evaluating the magnitude of potential risk areas. For example, buyers can use the ICM Risk Management application that allows configuring a questionnaire to perform supplier risk assessment. The risk areas can be identified based on the responses received for the questionnaire as the outcome of the risk assessment process.<br/> Risk assessment workflow performed by risk assessment owners typically involves the following:
| + | |
| − | | + | |
| − | *Initiating Risk Assessment: The risk assessment owners can instantiate the risk assessment workflow to identify the risks. For example, the risk assessment can be a questionnaire where the users respond to the questions by submitting the risk assessment. This initiates the risk assessment in Draft state.
| + | |
| − | *Risk Assessment approval: Based on the complexity of risk assessment, ICM administrators can configure the rules to add approvers to the assessment team. If there are approvers added to the assessment team, the risk assessment is sent to the approvers for approval. The risk assessment is approved automatically if no approvers are added to the assessment team.
| + | |
| − | *Risk Assessment Complete: The status of the risk assessment changes to Assessment Complete when the risk assessment is approved. The risk area can be identified and auto instantiated based on the configured rules.
| + | |
| − | | + | |
| − | <br/> Here is the Risk Assessment workflow at a glance:
| + | |
| − | | + | |
| − | image 6
| + | |
| − | | + | |
| − | == Creating a Risk Assessment ==
| + | |
| − | | + | |
| − | #Click the Risk Management tile on the Home page. The drop-down opens with options:
| + | |
| − | <ul style="margin-left: 40px;">
| + | |
| − | <li>Risk Assessment</li>
| + | |
| − | <li>Create Risk Assessment</li>
| + | |
| − | </ul>
| + | |
| − | | + | |
| − | screen 7
| + | |
| − | | + | |
| − | #Click Create Risk Assessment. The Attributes page for Create Risk Assessment opens. The Attributes page includes questions to capture the responses based on which the risk areas can be generated. These questions are non-seeded attributes and users can add them to the Risk Assessment contract type as per their business needs.
| + | |
| − | | + | |
| − | The sections on the attributes page can be:
| + | |
| − | <ul style="margin-left: 40px;">
| + | |
| − | <li>Identification</li>
| + | |
| − | <li>Risk Assessment Timeline</li>
| + | |
| − | <li>Supplier Perspective</li>
| + | |
| − | <li>Risk Assessment and Treatment</li>
| + | |
| − | <li>Security Policy</li>
| + | |
| − | <li>Organization Security</li>
| + | |
| − | <li>Asset and Information</li>
| + | |
| − | <li>Human Resource Security</li>
| + | |
| − | <li>Physical and Environmental</li>
| + | |
| − | <li>Ops Management</li>
| + | |
| − | <li>Access Control</li>
| + | |
| − | <li>Application Security</li>
| + | |
| − | <li>Incident Management</li>
| + | |
| − | <li>Business Resilience</li>
| + | |
| − | <li>Compliance</li>
| + | |
| − | </ul>
| + | |
| − | <ol start="3">
| + | |
| − | <li>Enter the details in fields in the Identification section:</li>
| + | |
| − | </ol>
| + | |
| − | <ul style="margin-left: 40px;">
| + | |
| − | <li>Risk Assessment Name: Enter the risk assessment name. To make it easier for the users of your organization to find the risk assessment, the name should include some basic information about the risk assessment. For example, purpose of the risk assessment. For example, enter a name as Risk_Assessment_May2020.</li>
| + | |
| − | <li>Risk Assessment Description: Enter the description of the risk assessment you are creating. This should include information that will help in finding the risk assessment based on the information you entered. For example, this is created to assess the probable risks due to the COVID-19 pandemic. </li>
| + | |
| − | <li>Risk Assessment Entity: Select the entity for which you are creating the risk assessment. This includes entities which might be at risk. For example, select Business Operations.</li>
| + | |
| − | </ul>
| + | |
| − | | + | |
| − | screen 8
| + | |
| − | <ol start="4">
| + | |
| − | <li>Enter the details in fields in the Risk Assessment Timeline section.</li>
| + | |
| − | </ol>
| + | |
| − | <ul style="margin-left: 40px;">
| + | |
| − | <li>Assessment Start Date: Select the start date of the assessment. This is the date from which you want to assess the probable risks to business due to specific reasons. For example May 31, 2020.</li>
| + | |
| − | <li>Assessment End Date: Select the end date of the assessment. This is the date till which the probable risks to business will be assessed. For example, June 1, 2020.</li>
| + | |
| − | </ul>
| + | |
| − | | + | |
| − | screen 9
| + | |
| − | <ol start="5">
| + | |
| − | <li>Enter the details in fields in all the sections on the Attributes page.</li>
| + | |
| − | <li>Click Next. The Verify page opens.</li>
| + | |
| − | </ol>
| + | |
| − | | + | |
| − | Note: The template to create the risk assessment is seeded and selected through the configured Template Selection rule.
| + | |
| − | <ol start="7">
| + | |
| − | <li>Click Create. The risk assessment is created in Draft state. </li>
| + | |
| − | </ol>
| + | |
| − | | + | |
| − | screen 10
| + | |
| − | | + | |
| − | Once created, users can Edit, Delete, Cancel or Submit the Risk Assessment.
| + | |
| − | | + | |
| − | === Searching and viewing the Risk Assessment ===
| + | |
| − | | + | |
| − | #Click the Risk Management > Risk Assessment on the Home page.
| + | |
| − | | + | |
| − | screen 11
| + | |
| − | | + | |
| − | The saved search result page opens with all Risk Assessment records.
| + | |
| − | | + | |
| − | screen 12
| + | |
| − | <ol start="2">
| + | |
| − | <li>Click the View Record icon next to the Risk Assessment record you want to open. For example, Risk_Assessment_May2020. The Risk Assessment Details page opens.</li>
| + | |
| − | </ol>
| + | |
| − | | + | |
| − | screen 13
| + | |
| − | | + | |
| − | === Editing the Risk Assessment ===
| + | |
| − | <ol start="3">
| + | |
| − | <li>Click Edit on the Risk Assessment Details page. The Edit Agreement page opens.</li>
| + | |
| − | </ol>
| + | |
| − | | + | |
| − | screen 14
| + | |
| − | <ol start="4">
| + | |
| − | <li>Make the required changes and click Next. The Verify page opens.</li>
| + | |
| − | <li>Verify the details and click Update. The risk assessment is updated and remains in Draft state.</li>
| + | |
| − | </ol>
| + | |
| − | | + | |
| − | === Canceling the Risk Assessment ===
| + | |
| − | <ol start="6">
| + | |
| − | <li>Click Cancel on the Risk Assessment Details page.</li>
| + | |
| − | </ol>
| + | |
| − | | + | |
| − | screen 15
| + | |
| − | | + | |
| − | The confirmation window opens.
| + | |
| − | | + | |
| − | screen 16
| + | |
| − | <ol start="7">
| + | |
| − | <li>Click Yes. The Add Note window opens.</li>
| + | |
| − | </ol>
| + | |
| − | | + | |
| − | screen 17
| + | |
| − | <ol start="8">
| + | |
| − | <li>Add note text and select the Reason Code.</li>
| + | |
| − | <li>Click Add. The Risk Assessment status changes to Cancelled.</li>
| + | |
| − | </ol>
| + | |
| − | | + | |
| − | screen 18
| + | |
| − | | + | |
| − | === Deleting the Risk Assessment ===
| + | |
| − | <ol start="10">
| + | |
| − | <li>Click Delete on the Risk Assessment Details page. The risk assessment will be deleted.</li>
| + | |
| − | </ol>
| + | |
| − | | + | |
| − | screen 19
| + | |
| − | | + | |
| − | === Submitting the Risk Assessment ===
| + | |
| − | <ol start="11">
| + | |
| − | <li>Click Submit on the Risk Assessment Details page. The risk assessment is sent for approval and its status changes to Waiting for Approval. </li>
| + | |
| − | </ol>
| + | |
| − | | + | |
| − | screen 20
| + | |
| − | | + | |
| − | Approvers can Approve or Reject the Risk Assessment from the risk assessment Details page.
| + | |
| − | | + | |
| − | '''To reject:'''
| + | |
| − | <ol start="12">
| + | |
| − | <li>Click Reject. The Add note window opens.</li>
| + | |
| − | </ol>
| + | |
| − | | + | |
| − | screen 21
| + | |
| − | <ol start="13">
| + | |
| − | <li>Add note text and select the Reason Code.</li>
| + | |
| − | <li>Click Add. The Risk Assessment goes back to Draft state.</li>
| + | |
| − | </ol>
| + | |
| − | | + | |
| − | '''To approve:'''
| + | |
| − | <ol start="15">
| + | |
| − | <li>Click Approve. The Add Note window opens. </li>
| + | |
| − | <li>Add note text and select the Reason Code.</li>
| + | |
| − | <li>Click Add. The Risk Assessment state changes to Assessment Complete.</li>
| + | |
| − | </ol>
| + | |
| − | | + | |
| − | If there are no Approvers added to the Risk Assessment Team, the record will be approved directly and move to the Assessment Complete state.<br/>
| + | |
| − | | + | |
| − | screen 22
| + | |
| − | | + | |
| − | Note: The Assessment Complete state is the final state for Risk Assessment, and users cannot take further actions.
| + | |
| − | | + | |
| − | === Auditing Risk Assessment ===
| + | |
| − | | + | |
| − | Changes made to the Risk Assessment record during various ICM risk management workflows are captured and can be viewed under History tab. For example, changes in Risk_Assessment_May2020 throughout its lifecycle are captured.
| + | |
| − | | + | |
| − | screen 23
| + | |
| − | | + | |
| − | == Working with Risk Area ==
| + | |
| − | | + | |
| − |
| + | |
