Associate risks, citations, policies, and controls with a risk identification record
After the inherent assessment is completed, you can associate risks, citations, policies, and controls with the risk identification record. You can identify what methods to use to mitigate the risks.
Before you begin
Role required: sn_risk.manager and sn_compliance.manager
About this task
Risks, citations, and policies can be associated manually or by using the recommendation engine. The recommendation engine provides automatic suggestions for risk, citations, and policies. The choice to enable the recommendation engine is made in the risk identification configuration record. The choice is available only for the business application table. For the recommendations to be enabled, the risks statements, citations, and policies must have information objects.
Procedure
Navigate to All > Advanced Risk Assessment > Risk Identification > All.
Open the record for which you want to associate risks, citations, and policies.
This is the record for which you performed the inherent assessments.
Click Associate Risks.
The Information Objects Mapping related list and the Risks related list appear. At this stage, you can either manually add risks or allow the recommendation engine to recommend risks.
To add risks manually, click Add from library.
To use the recommendation engine, do the following:
Click Recommend Risks to use the recommendation engine.
Select the appropriate risk statement and click Add Risks.
To add citations and policies, click Associate Citations and Policies.
The Citations related list and Policies related list appear.
Add the required citations and policies either manually from the library or by using the recommended policies and citations.
To associate controls, click Associate Controls.
Add the required controls either manually from the library or by clicking Recommended Controls.
The controls are created based on the control objectives.
To move a control to the Attest state, select the control and click Initiate Attestation.
Click Monitor to move the record to Monitor state.
Recommendation engine for risk and compliance mapping
A recommendation engine is a system that suggests products, services, and information to users based on data analysis. A recommendation engine boosts revenues and other essential metrics.- Information objects
Information objects are a part of the information portfolio management capability in the Application Portfolio Management application.
Parent Topic:Application risk assessment using Advanced Risk Assessment
Related topics