Monitor Risks

• Input - Risks that have been entered but not formally accepted into the system.
• Open/Active – Risks that are currently active.
• Other/Active – Risks which have been assigned non-system status codes are listed here.
• Cancelled – Risks that may not now be required (e.g. duplicate Risk).
• Closed – Risks that do not exist now.
• Total Risks – Risks that exist in the system regardless of status.
• Reviews Overdue – Risks where the review date has passed.
• Reviews Due – Risks where the review date is approaching (within the time band configured in System Settings).
• Risk Events – Potential Risk Events set up in the system.
• Risk Events Used – The number of Risk Events that have associated Risks.
• Owners – The number of people (and/or roles) that own Risks.
• Active Owners – The number of people (and/or roles) that own Risks that are currently open/active.
• Extreme Risks – The number of Risks that are currently rated at the highest level.
• High Risks – The number of Risks that are currently rated at the second highest level.

Monitor Actions

• Input – Actions associated with Risks that have not formally been accepted into the system.
• In Progress – Actions associated with Risks that are open/active and neither the Action
• Due Date nor the Action Date Completed has been entered.
• Scheduled – Actions which have been assigned a Due Date.
• Completed – Actions associated with Risks that are open/active and the Action Date Completed has been entered.
• Non-Active – Actions associated with Risks that are not open/active.
• Total Actions – Actions that exist in the system regardless of status.
• Actions Overdue – Actions where the due date has passed.
• Actions Due – Actions where the due date is approaching (within the time band set up in System Settings).
• Standard Actions – The number of Action Codes in the system.
• Action Used – The number of Action types which includes ad hoc Actions and standard mitigations set up in the system. The count may be more than Actions Available due to ad hoc Actions.
• Action Owners – The number of people (and/or roles) that own Actions.
• Active Owners – The numbers of people (and/or roles) that own Actions that are currently open/active.
• Critical Actions – The number of Actions that are associated with Risks that are currently rated at the highest level.
• Urgent Actions – The number of Actions that are associated with Risks that are currently rated at the second highest level.

Pie Charts

If your installation has a charting license then you will be able to see a small chart on either side of the Risk matrix as follows: The left chart will show Risks entered by month for the last 12 months and the right chart shows Actions completed by month for the last 12 months.

Enterprise Rating

At some high level places in the system such as the Dashboard and the Risk Matrix display, you have the option to view things by Assessed Rating (without the effect of any Action), Residual Rating (as rated in the business unit when one or more Actions have been completed) and Enterprise Rating (the rating that applies across the enterprise, and which may be lower than the business unit rating).

• Assessed Rating is determined by the intersection between Assessed Likelihood and Assessed Consequence.
• Residual Rating is determined by the intersection between Residual Likelihood and Residual Consequence.
• Enterprise Rating is determined by the intersection between Residual Likelihood and Enterprise Consequence. That is, Enterprise Rating still uses the Residual Likelihood but overrides the Residual Consequence with the Enterprise Consequence.

The Enterprise Consequence is determined by taking the Retained Risk (a monetary amount and being the Potential Loss in monetary terms reduced by the effectiveness of any Consequence Actions) and looking up the cut-off value in the Enterprise Rating table to see where it fits in the overall appetite for Risk for the enterprise.

To recap:

The formula for Assessed Rating is derived from the Assessed Likelihood and Assessed Consequence.

The formula for Residual Rating is derived from the Residual Likelihood and Residual Consequence.

The formula for Enterprise Rating is derived from the Residual Likelihood and Enterprise Consequence.

The Enterprise Consequence is derived from the Cut-off Value in the Enterprise Rating table. In other words, we are ignoring the allocated Assessed Consequence and the derived Residual Consequence. Instead, we are focusing on the potential monetary loss or, more correctly, the residual monetary loss, then looking up the monetary Cut-off Value in the Enterprise Rating table. This allows business units to rate Risks as they see them, but, at the highest level (the enterprise level), the consequence can be adjusted down as the residual loss may not be that important to the company overall.