Automating operational risk assessments

In the Projects app, you can create assessment drivers based on a metric to automate operational risk assessments and notify key stakeholders when changes occur.

Before you start

Before you can automate a risk assessment, you need to set up a project with objectives, risks, and controls, and configure risk scoring. To turn on the Automate button, you or someone on your team needs to complete the following tasks:

How it works

After you have completed the prerequisite tasks, you create an assessment driver by:

  1. selecting the risk assessment you want to automate
  2. defining metric ranges that will be used to populate inherent risk scores for the risk assessment

Once you create the assessment driver, the assessment is automatically updated whenever the metric value crosses a specified threshold. Whenever the risk assessment changes, stakeholders are automatically notified via the Projects daily summary email, enabling them to take appropriate action.

Why do assessment drivers automate inherent risk scores?

Assessment drivers automate inherent risk scores to inform you about your organization's current level of risk. Since risk assessments are an on-going and iterative process, inherent risk scores may change with time.

Based on the inherent risk score, you can determine whether the risk poses a threat to your organization or if the risk is less critical to your organization. Risk response options may include increasing or decreasing resources associated with risk treatment, as needed.

What changes in Projects impact the way assessment drivers work?

Depending on the change, assessment drivers are enabled, disabled, copied, or permanently deleted.

Change Impact
Deleting a metric in Results that has been linked to a risk in Projects

Once a metric is associated with an assessment driver, any metric configuration changes you make in Results disables the risk assessment automation in Projects.

The most recent inherent risk score is retained and the risk assessment becomes a manual process.

Note

You can fix the problems in Results or Projects and re-enable the assessment driver.

Changing the configuration of a metric in the Results
Changing the scale associated with a risk scoring factor

Any associated assessment drivers are disabled.

  • If the score value remains (i.e. previously 1 = Low and now 1 = None), the same score is retained.
  • If the score value is no longer available (i.e. previously 5 = Very High, and now you are using a 3-point scale), the score is removed so that you can reassess the risk.

Archiving a project or deleting a project temporarily

Any associated assessment drivers are disabled. The most recent inherent risk score is retained.

Unarchiving a project or restoring a project

Any associated assessment drivers that were not manually disabled or broken prior to archiving the project are automatically re-enabled. The most recent inherent risk score is retained.
Importing controls, cloning or importing objectives, or rolling forward projects

Any associated assessment drivers and linked metrics are copied:

  • when the project type of the source project and target project are the same
  • from archived to active projects or active to active projects within the same Diligent One instance

    Assessment drivers are automatically enabled in the target project.

If the project type of the source project and target project are different, assessment drivers are not copied to the target project.
Unlinking a metric from a risk in Projects

Any associated assessment drivers are permanently removed.

The most recent inherent risk score is retained and the risk assessment becomes a manual process.
Deleting a risk scoring factor Any associated assessment drivers are permanently removed.
Deleting an objective (that contains the risk) from a project
Deleting a risk from a project

Permanently deleting a project

Permissions

Professional Managers and Professional Users can automate risk assessments. All other roles can only view automated risk assessments.

Configure an automated risk assessment

Navigate to a risk in a project

Note

  • Interface terms are customizable, and fields and tabs are configurable. In your instance of Diligent One, some terms, fields, and tabs may be different.
  • If a required field is left blank, you will see a warning message: This field is required. Some custom fields may have default values.

  1. From the Launchpad home page (www.highbond.com), select the Projects app to open it.

    If you are already in Diligent One, you can use the left-hand navigation menu to switch to the Projects app.

    The Projects home page opens.

  2. Open a project.

    The project dashboard opens.

  3. Click the Fieldwork tab.
  4. Locate the appropriate objective, click Go To, and select Risk Control Matrix.
  5. Click the title of the appropriate risk.
  6. Under the Rating section, next to the appropriate risk scoring factor, click Automate RiskScoringFactor .

    The Assessment Drivers side panel opens, with the objective, risk, and risk scoring factor pre-selected.

Specify a metric and define ranges

  1. Click the Select a Metric... dropdown list to specify the metric that will be used to populate inherent risk scores. The metric must generate a numeric value. You cannot use metrics based on dates. You can only select metrics that have been linked to the selected risk.
    Note

    If you previously linked a metric, and archived the collection in Results where the metric is located, the metric is protected in a read-only state. No data can be added or changed.

  2. Select the appropriate operator (less than or greater than) and define the conditions that need to occur for the risk assessment to automatically update to the specified score.

    As you enter values in the right column, the left column is auto-populated with the next sequential value, and the score changes color once you have entered a number for the row.

    You can enter any number of decimal places for each value. However, upon saving, values only display up to two decimals.

    Tip

    You can use Tab to quickly move vertically down the right column.

  3. Optional. Disable the Assessment Driver if you do not want to automate the risk assessment immediately.

    By default, the Assessment Driver is enabled , and the assessment is automated immediately after saving. Once the Assessment Driver is enabled, you cannot update the value of the risk assessment manually.

  4. Click Save.

    Result The risk assessment is automated.

    Note

    You must define all metric ranges before you can save.

View or edit automated risk assessments

  1. Navigate to the appropriate risk in the project.
  2. Under the Rating section, view automated risk assessments:
  3. To edit or enable / disable an assessment driver, click Edit RiskScoringFactor next to the appropriate risk assessment.

    The Assessment Drivers side panel opens, allowing you to view or configure the assessment driver.

Delete an assessment driver

Note

When you delete an assessment driver, the most recent inherent risk score is retained, and the risk assessment becomes a manual process.

  1. Navigate to the appropriate risk in the project.
  2. Under the Rating section, click Edit RiskScoringFactor next to the appropriate risk assessment.

    The Assessment Drivers side panel opens.

  3. Click Delete and click Delete in the confirmation popup to delete the assessment driver.

    The assessment driver is permanently removed from the Projects app.