View source for ICI Risk Management

== Working with Risk Area ==

Managing Risk Area includes:&nbsp;

*Ensuring the validity of the identified risk area 
*Devising strategies to mitigate risks 
*Tracking the performance until risks are completely mitigated 

The risk area can be generated automatically by seeded rules based on the risk assessment responses. Users can also add the risk area manually to the risk assessment.

=== <br/> Creating Risk Area automatically using rules ===

The ICI Risk Management application provides set of rules to generate Risk Areas automatically based on the responses gathered from the risk assessment. Refer the ICI Risk Management Configuration Guide&nbsp;for details on rules used in the ICI Risk Management application.

The workflow for generating risk areas automatically includes process as follows:

1.&nbsp;A recommended rule Identify Risk Areas on the event Risk Assessment Created identifies applicable risk areas based on the specific attribute values from the Risk Assessment record.

For example, the sample Identify Risk Areas rule with the attribute Risk Assessment Description. When this attribute has the response as Assessment for Supplier, then the Applicable Risk Area is identified and set as Anti Bribery & Corruption.
<div class="image-green-border">[[File:7.12-RiskAreausingRules.png|720px|7.12-RiskAreausingRules.png]]</div> <div class="image-green-border">&nbsp;</div> <div class="image-green-border">2.&nbsp;Once the ''Risk Areas'' are identified, the seeded rule Auto instantiate applicable risk area generates those identified risk areas.</div> <div class="image-green-border">3.&nbsp;Another seeded rule Copy attribute values then copies values specified in the rule from Risk Assessment record to the Risk Areas.</div> <div class="image-green-border">For example, when the Risk_Assessment_May2020 is approved, the risk area is automatically created as Anti Bribery & Corruption.</div> <div class="image-green-border">&nbsp;</div> <div class="image-green-border">[[File:7.12-RiskAreaList.png|720px|7.12-RiskAreaList.png]]</div> 
&nbsp;

=== Creating Risk Area manually&nbsp; ===

To create a risk area for risk assessment:&nbsp;

1.&nbsp;'''Click '''Risk Management > Risk Assessment on the Home page. The search results page with all risk assessment records opens.

2.&nbsp;'''Click '''the ''View Record'' icon next to the Risk Assessment for which you want to create Risk Area. The ''Risk Assessment Details'' page opens.

3.&nbsp;'''Click '''''Create Association'' action icon (plus sign) next to ''Risk Area'' under the Associations. The ''Create Association'' for ''Risk Area'' page opens.
<div class="image-green-border">[[File:7.12-CreateRiskArea.png|720px|7.12-CreateRiskArea.png]]</div> 
The Create Association Risk Area page has sections:

*Reference Risk Assessment 
*Risk Area Details&nbsp; 
*Inherent Risk Rating&nbsp; 
*Risk Remediation Plan&nbsp; 
*Residual Risk Rating&nbsp; 

4.&nbsp;'''Select '''or '''enter''' the details in the attributes in all the sections. The attributes can be mandatory, lookup type, cascading, conditional, multi-select and so on.

'''Reference Risk Assessment'''

This section contains the attributes:

*Risk Assessment Name: This field is populated automatically based on the information entered when creating the risk assessment.&nbsp; 
*Risk Assessment Description: This field is populated automatically based on the information entered when creating the risk assessment.&nbsp; 
<div class="image-green-border">[[File:7.12-ReferenceRiskArea.png|720px|7.12-ReferenceRiskArea.png]]</div> 
'''Risk Area Details&nbsp;'''

This section contains the attributes:&nbsp;

*Risk Area Instance ID: This is generated automatically after the risk area is created. 
*Risk Area Name: '''Select''' the risk area name from the drop-down list. This populates the information for the following attributes from the masterdata.&nbsp; 
**Risk Area Master ID&nbsp; 
**Short Description 
**Category 
**Sub Category 
**''Risk Area Owner''   
*Origin: '''Enter''' the description that contains information about the probable source of risk area.&nbsp; 
*Effect: '''Enter''' the description about the probable effects of the risks foreseen based on the risk assessment created. 
*Additional Risk Area Owners: If risk area owner is not available in master, then user can add additional risk area owners.&nbsp;<br/> &nbsp; 

Risk Area owners are Subject Matter Experts who can look into risk area end to end for validity of risk, planning risk remediation, monitoring the progress and performance of risk remediation actions
<div class="image-green-border">[[File:7.12-RiskAreaOwners.png|720px|7.12-RiskAreaOwners.png]]</div> 
&nbsp;
<div class="note-box">'''Note''': The certain values in the risk area details section can be auto-populated from Risk Area Master . The Risk Owner and Additional Risk Area Owners can be added to the risk area team through configured rules.</div> 
'''Inherent Risk Rating&nbsp;'''

Inherent risk rating is the risk rating applicable to the risk when it was determined for the first time.<br/> This section contains the attributes:

*Inherent Risk Trigger Date: The date and time on which the inherent risk record is created. 
*Inherent Likelihood Rating: The probability of occurrence of risk. 
*Inherent Consequence Rating: The impact or consequence of risk occurrence.&nbsp; 
*Inherent Risk Level:Qualitative scoring based on likelihood of risk occurrence and consequence if risk occurred.&nbsp; 
*Inherent Risk score:Quantitative scoring based on likelihood of risk occurrence and consequence if risk occurred.&nbsp; 
<div class="note-box">Note: The Inherent risk level and score is determined from the values in inherent likelihood rating and consequences rating and can be entered manually or by configuring rules.</div> 
*Comments: This includes any additional information that you might want to provide regarding the risk assessment created. 
<div class="image-green-border">[[File:7.12-RiskArea-InherentRiskRating.png|720px|7.12-RiskArea-InherentRiskRating.png]]</div> 
'''Risk Remediation Plan&nbsp;'''

This section includes the informaton related to the remediation strategies and actions that can be taken to mitigate the risk areas.<br/> This section contains the attributes:&nbsp;

*Remediation Action: '''Enter''' the remediation action that is planned to be taken to minimize the probable risks.&nbsp; 
*Control Effectiveness: '''Select''' the level from the drop-down list that defines the level of effectiveness of measures that will be applied to minimize the risks. 
*Remediation Action Details: '''Enter''' the remediation action details that describe the remediation actions that will be taken to minimize the risk.&nbsp; 
<div class="image-green-border">&nbsp;[[File:7.12-RiskAreaRemediation.png|720px|7.12-RiskAreaRemediation.png]]</div> 
'''Residual Risk Rating'''<br/> This section includes the information related to the residual risk left after the remediation actions are taken.<br/> This section contains the attributes:

*Residual Risk Update Date: The date on which the residual risk record is updated. 
*Residual Likelihood Rating: This indicates the likelihood of occurrence of the remaining risk.&nbsp; 
*Residual Consequence Rating: This indicates impact of occurrence of the remaining risks happening after the mitigations actions are implemented. 
*Residual Risk Level: Qualitative scoring based on likelihood and consequence if residual risk occurred.&nbsp;&nbsp; 
*Residual Risk Score: Quantitative scoring based on likelihood and consequence if residual risk occurred.&nbsp; 
*Comments for Residual Risk:&nbsp;This includes any additional information that you might want to provide regarding the risk area. 
<div class="image-green-border">[[File:7.12-ResidualRiskRating.png|720px|7.12-ResidualRiskRating.png]]</div> 
5.&nbsp;'''Click '''''Create''. The Risk Area is created in Assessment state.&nbsp;
<div class="image-green-border">[[File:7.12-RiskAreaCreatedList.png|720px|7.12-RiskAreaCreatedList.png]]</div> <div class="image-green-border">&nbsp;</div> 
=== Searching Risk Area records ===

Risk Area records can be searched from:

*Advanced Search page 
*Global Search 
*Associations index page 

To&nbsp;search risk area from Advanced Search page:

1.&nbsp;'''Click''' ''Search'' tile on the ICI UI. The ''Advanced Search'' page opens.<br/> 2. '''Select '''Risk Area in the Please select Entities to search field.<br/> 3. '''Click''' the search icon. All available Risk Area records are displayed.
<div class="image-green-border">[[File:7.12-RiskArea-AdvancedSearch.png|720px|7.12-RiskArea-AdvancedSearch.png]]</div> 
&nbsp;

To search risk area using Global Search&nbsp;

Enter the relevant search criteria in the Enter search here…search bar on the ICI UI. For example, Risk Area. All available Risk Area records are displayed in a drop down.
<div class="image-green-border">[[File:7.12-RiskArea-GlobalSearch.png|720px|7.12-RiskArea-GlobalSearch.png]]</div> 
&nbsp;

To search risk area from association index page:

1.&nbsp;'''Click '''Associations Management > Associations on the Home page. The Associations index page opens.

2.&nbsp;'''Filter '''the records for Risk Area entity using Categories facet search. All available Risk Area records are displayed.
<div class="image-green-border">&nbsp;[[File:7.12-RiskArea-AssociationIndexpage.png|720px|7.12-RiskArea-AssociationIndexpage.png]]</div> 
&nbsp;

=== Working of existing ICI actions for Risk Area ===

Risk area owner can take existing ICI actions for associations on risk area.

*View Document: Opens the preview of the risk area if available, in the Document Viewer window. 
*View Smart Link: Opens the smart links if available, in a Smart Links window.&nbsp; 
*Dissociate: Displays the error message as Oops something went wrong, please try again.&nbsp;: You do not have necessary access privileges for this functionality, 
*Copy: Copies risk area instance. 
*Edit: Opens the Edit Associated Document - Risk Area page to modify the details of the risk area instance. 
<div class="image-green-border"><br/> [[File:7.12-ICIActionsforRiskArea.png|720px|7.12-ICIActionsforRiskArea.png]]</div> <div class="image-green-border">&nbsp;</div> 
=== Taking actions on the Risk Area ===

The Risk owner can be added to the risk area through configured rules. Risk owner can&nbsp;then take certain actions from the risk area Details page. &nbsp;<br/> The actions can be:

*Initiate Due Diligence - action taken to capture more information related to the risk and validate the identified risk area.&nbsp; 
*Remediate - action taken to mitigate the valid risk area. 
*Deactivate - action taken for risk area&nbsp;identified as invalid. Users cannot take further &nbsp;actions once the risk area is deactivated. 
*Monitor - action taken to track the performance based on remediation actions until risks are completely mitigated 

Users can repeat the workflow Due Diligence – Remediate – Monitor until the risk is completely mitigated.<br/> Users can also automate the workflows to initiate due diligence, remediate and monitor risk areas by configuring rules.<br/> &nbsp;

==== Editing Risk Area ====

1.&nbsp;'''Click '''Risk Management > Risk Assessments on the Home page. The list of all available risk assessments opens.

2.&nbsp;'''Click '''View Record icon next to the Risk Assessment you want to opens. The Risk Assessment Details page opens.

3.&nbsp;'''Click '''Risk Area tab in the left navigation. The risk area grid opens.

4.&nbsp;'''Click '''View Record icon next to the risk area you want to open. The risk area Details page opens.

5.&nbsp;'''Click '''Edit. The Edit Associated Document for Risk Area page opens.
<div class="image-green-border">[[File:7.12-EditRiskArea.png|720px|7.12-EditRiskArea.png]]</div> 
6.&nbsp;'''Make '''the required changes and click Update. The Risk Area is updated and the Risk Area Details page opens again.
<div class="image-green-border">[[File:7.12-UpdateRiskArea.png|720px|7.12-UpdateRiskArea.png]]</div> 
&nbsp;

Users can edit the risk area from risk area details page as well.
<div class="image-green-border">[[File:7.12-EditRiskArea1.png|720px|7.12-EditRiskArea1.png]]</div> <div class="image-green-border">&nbsp;</div> 
==== Initiating Due Diligence ====

'''Click '''Initiate Due Diligence. The Risk Area Details page opens again.&nbsp;
<div class="image-green-border">[[File:7.12-InitiateDueDiligence.png|720px|7.12-InitiateDueDiligence.png]]</div> 
The status of the risk area changes to Due Diligence.
<div class="image-green-border">[[File:7.12-InitiateDueDiligence1.png|720px|7.12-InitiateDueDiligence1.png]]</div> <div class="image-green-border">&nbsp;</div> <div class="image-green-border">&nbsp;</div> 
==== Remediating the risk area ====

'''Click '''Remediate on the risk area Details page. The Risk Area Details page opens again.&nbsp;
<div class="image-green-border">[[File:7.12-RemediateRiskArea.png|720px|7.12-RemediateRiskArea.png]]</div> 
The risk area Details page opens again and the status of the risk area changes to Remediation..
<div class="image-green-border">[[File:7.12-RiskAreaRemediation1.png|720px|7.12-RiskAreaRemediation1.png]]</div> 
&nbsp;

==== Monitoring the risk area ====

Users can monitor the risk areas based on the remediation actions taken to check whether the risks are reduced.&nbsp;

To monitor a risk area:&nbsp;

'''Click''' ''Monitor'' on the risk area Details page. The risk area ''Details'' page opens again and the status of the risk area changes to ''Monitoring''.&nbsp;
<div class="image-green-border">[[File:7.12-MonitoringRiskArea1.png|720px|7.12-MonitoringRiskArea1.png]]</div> 
The status of the risk area changes to Monitoring.
<div class="image-green-border">[[File:7.12-MonitoringRiskArea.png|720px|7.12-MonitoringRiskArea.png]]</div> 
&nbsp;

==== Iterating workflow&nbsp;for risk area ====

Users can repeat the actions taken on the risk areas until the risks are completely mitigated.

1.'''Click '''Initiate Due Diligence or Remediate on the risk area Details page for the risk area in the Monitoring state. For example, select Initiate Due Diligence. The Association ''Initiate Due Diligence note'' window opens to add a note.

2.'''Add '''a note text and select a Reason code.
<div class="image-green-border">[[File:7.12-Association Initiate Due Diligence.png|720px|7.12-Association Initiate Due Diligence.png]]</div> 
3.&nbsp;'''Click '''Add. The status of the risk area changes back to Due Diligence.
<div class="image-green-border">[[File:7.12-Association Initiate Due Diligence1.png|720px|7.12-Association Initiate Due Diligence1.png]]</div> 
&nbsp;

==== Deactivating the risk area ====

Risk owners can deactivate the invalid risk area. Once deactivated, no further actions are allowed on the risk area.

1.&nbsp;'''Click '''Deactivate on the risk area Details page. The Association Deactivate note window opens to add a note.
<div class="image-green-border">[[File:7.12-DeactivateRiskArea.png|720px|7.12-DeactivateRiskArea.png]]</div> 
2.&nbsp;'''Add '''a note text and select a Reason code.
<div class="image-green-border">[[File:7.12-DeactivateRiskArea1.png|720px|7.12-DeactivateRiskArea1.png]]</div> 
3.&nbsp;'''Click '''Add. The status of the risk area changes to Deactivated.
<div class="image-green-border">[[File:7.12-DeactivateRiskArea2.png|720px|7.12-DeactivateRiskArea2.png]]</div> 
&nbsp;

==== Auditing Risk Area ====

Changes made to the Risk Area record during various ICI risk management workflows are captured and can be viewed under History tab. For example, changes in ICIRiskArea_372 throughout its lifecycle are captured.
<div class="image-green-border">[[File:7.12-AuditingRiskArea.png|720px|7.12-AuditingRiskArea.png]]</div> <div class="image-green-border">&nbsp;</div> 
'''Click''' ''Show All Changes'' to view the details of the particular event of the risk area instance.
<div class="image-green-border">[[File:7.12-AuditingRiskArea1.png|720px|7.12-AuditingRiskArea1.png]]</div> 
&nbsp;

'''Moving Risk Area workflow automatically'''

The users can manage the Risk Assessment and Risk Area action workflows using the script attribute Target ICM Status. Users can set the value in Target ICM Status to specific status and move records to that particular state during the risk management workflow.&nbsp;For example, risk area record can be moved from the Draft &nbsp;state to either Due Diligence, Remediation or Monitoring state using attribute Target ICM status .

Risk assessment and risk area records can be uploaded in ICI directly in specific status by setting the state value in the Target ICM Status attribute using ICI’s Legacy Upload functionality. The business status would then be set accordingly.

For example, when users want to upload large number of historical risk assessment records using Legacy Upload, they can directly upload in the Approved state by setting it in the Target ICM Status attribute and the business state would be set as Assessment Complete.

Refer &nbsp;the ICI Risk Management Configuration Guide for details on Managing Risk Workflows using attribute Target ICM Status.

&nbsp;