Risk Suite 2 Set-up

From SymbiantWiki

Symbiant Risk Suite is highly customisable, even down to the interfaces and wording of key risk terms, for more details on customising the interface and changing text see the separate customisation guides.

In set-up you can configure user groups, risk objectives, drop-downs, i.e. categories, set the scoring for impact and likelihoods etc. It is also possible to create custom email messages to be sent for all the key points in a risk life cycle, for example when voting starts on workshops or is about to finish. A further useful feature that can be customised here is the text that will be displayed on the login and start pages as well as the top and bottom of reports.

Contents 1 User Groups 1.1 Add New 1.2 Amend 1.3 Move 1.4 Delete 2 Categories 2.1 Add New 2.2 Amend 2.3 Move 2.4 Delete 3 Business Objectives 3.1 Add New 3.2 Amend 3.3 Move 3.4 Delete 4 Drop-downs 4.1 Add New 4.2 Amend 4.3 Move 4.4 Delete 5 Scoring 5.1 Add New 5.2 Amend 5.3 Move 5.4 Delete 6 Import 7 Welcome Text 8 Reports 9 Emails

User Groups

Groups are used to categorise users and give control to Managers over certain groups of users and workshops (see Account for more details).

Add New

To add a new user group ensure that [<-- Add New -->] is selected in the Groups list and enter the Name of the new group. Click the [Add] button to add the new group.

Amend

To edit a group, select the group in the Groups list, amend the Name and click the [Add] button.

Move

To place a user group in an appropriate list position, select the group to be moved in the Items list and use the [Up] and [Down] buttons to reposition the item.

Delete

To remove a group, select the group to remove from the Groups list and click the [Remove] button. The system will ask you to confirm that you wish to delete the selected group; if you proceed the group will be removed. This operation is irreversible. If the group is assigned to a user or associated with workshops or questionnaires then it cannot be deleted until they are either deleted or the group removed from their respective lists.

Categories

Categories are used to group risks together.

Add New

To add a new user category ensure that [<-- Add New -->] is selected in the Items list and enter the Category name.

It is also possible to set a risk appetite for a category so that when considering the need for further controls it is easy to see if risks are within or outside acceptable limits. Check the [Enable] check box to enable appetites on the entered category.

Click the [Add] button to add the new category.

Amend

To edit a category, select the category in the Items list, amend the Category and/or the Appetite properties and click the [Add] button.

Move

To place a category in an appropriate list position, select the category to be moved in the Items list and use the [Up] and [Down] buttons to reposition the item.

Delete

To remove a category, select the category to remove from the Items list and click the [Remove] button. The system will ask you to confirm that you wish to delete the selected category; if you proceed the category will be removed. This operation is irreversible. If the category is in use by a risk then it cannot be deleted until the risk is either deleted or a new category assigned.

Business Objectives

Business objectives are the key goals of the company. They should identify what the company wishes to achieve and what any risks are likely to affect.

Add New

To add a new user business objective ensure that [<-- Add New -->] is selected in the Items list and enter the Objective details. Click the [Add] button to add the new objective.

Amend

To edit a business objective, select the objective in the Items list, amend the Objective details and click the [Add] button.

Move

To place a business objective in an appropriate list position, select the objective to be moved in the Items list and use the [Up] and [Down] buttons to reposition the item.

Delete

To remove a business objective, select the objective to remove from the Items list and click the [Remove] button. The system will ask you to confirm that you wish to delete the selected objective; if you proceed the objective will be removed. This operation is irreversible. If the objective is in use by a risk then it cannot be deleted until the risk is either deleted or a new objective assigned.

Drop-downs

Symbiant Risk Suite has various pre-defined drop-down lists from which users can select the required option.

The drop-downs are for:

Timescale i.e.

• Immediate
• Long Term
• Medium Term
• Short Term

Process i.e.

• Accounts Payable
• Supply Chain
• Sales
• Cash
• Bank

Op Unit Op Unit may be a branch or division or subsidiary company

Function i.e.

• Finance
• HR
• Marketing
• Operations
• Legal
• Compliance

IncidentArea i.e.

• Leeds
• Manchester

Question Type For the Assessment questionnaires, i.e.

• General
• Finance
• IT

Question Category For the Assessment questionnaires, i.e.

• General
• Accounts Receivable
• Purchasing

Add New

To add a new item to the selected list (Area) ensure that [<-- Add New -->] is selected in the Items list and enter the value in the Text field directly above the Items list. Click the [Add] button to add the new value to the selected Area.

Amend

To edit a value, select the value in the Items list, amend the Text and click the [Add] button.

Move

To place a drop-down entry in an appropriate list position, select the drop-down entry to be moved in the Items list and use the [Up] and [Down] buttons to reposition the item.

Delete

To remove an item from the selected list (Area), select the item to remove from the Items list and click the [Remove] button. The system will ask you to confirm that you wish to delete the selected item; if you proceed the item will be removed. This operation is irreversible. If the drop-down is in use by risks or questionnaires, then you will not be able to remove the drop-down until the risk or questionnaire is either removed or a new drop-down item assigned (this does not include incident areas).

Scoring

Symbiant Risk Suite has various pre-defined lists that represent certain scores or values from which the user can select the required option.

The scoring drop-downs are for:

Impact The impact the risk will have on the business, i.e.

• Insignificant
• Minor
• Moderate
• Major
• Catastrophic

Likelihood The likelihood the risk will occur, i.e.

• Rare
• Unlikely
• Moderate
• Likely
• Almost Certain

Appetite Risk appetite is a measure of the organisation's tolerance for risk. It is used to compare against the actual net risk scores to determine whether the net risk is now within the risk appetite (i.e. comfortable with it) or outside (and need to do more to manage that particular risk). The maximum appetite should be the product of the top impact and likelihood scores.

Treatment Treatments that are carried out on the risk, i.e.

• Tolerate
• Terminate
• Transfer
• Tame
• Take / Turnaround

Tracker State i.e.

• Accepted
• In Progress
• Completed

Add New

To add a new item to the selected list (Area) ensure that [<-- Add New -->] is selected in the Items list and enter the description in the Text field and a numeric value to represent the items score or importance. For examples of the values that should be used here, see Appendix A or click the [What do I enter here] link in set-up. Click the [Add] button to add the new value to the selected Area.

Amend

To edit a score, select the score in the Items list, amend the Text and/or Value and click the [Add] button.

Move

To place a score in an appropriate list position, select the score to be moved in the Items list and use the [Up] and [Down] buttons to reposition the item.

Delete

To remove an item from the selected list (Area), select the item to remove from the Items list and click the [Remove] button. The system will ask you to confirm that you wish to delete the selected item; if you proceed the item will be removed. This operation is irreversible. It is important to note that items deleted from the system are removed from the drop-downs and any risks they are assigned to. This means that if, for example, a risk impact is removed, and that impact is used to score a risk, that risk will not be displayed in any votes based reports until it has a new impact assigned to it.

Import

Risk Suite 2.0 includes a BETA version of the importer. The import functions of this BETA release allow the importing of risks from an Excel based worksheet.

Risks must be imported into Risk Suite using an Excel (.xls) spreadsheet file. The data to be imported should be contained on the first worksheet (named 'Sheet1'). This sheet should contain each risk to be imported on separate rows. Each field should be a separate column. The columns should be named appropriately in the first row.

Clicking the [Scan] button will try to correctly map the columns in the worksheet to those in Risk Suite (it is important to double check they are all mapped correctly). If any of the fields are not included on the worksheet ensure a default value is set for them. The worksheet should not include any formatting or blank rows. It is important to ensure that the maximum character allowance for each field is not exceeded (see the user guide for details on the number of characters each field can contain), any fields that exceed the character limit will be truncated. Any field that fails to correctly import will be replaced with the default value.

Please note, importing data from a spreadsheet can take several minutes, please ensure that your server will not time-out in the middle of the import.

If Workshop is set to [unassigned] the Importer will import the risks into the Risk Universe. From here the risks can be assigned to any workshop whose status is set to open by assigning risks.

Welcome Text

When you login to Symbiant Risk Suite or are viewing the Start Page custom text defined on this screen is displayed. The login text is normally used to inform users what to do should they forget their login details or if they cannot access the system for whatever reason. The Start Page text should welcome the users to the system, provide details on important information such as risk deadlines, changes, and maybe provide links to further resources.

Click the [Save] button to save the changes you have made, the changes will take effect the next time the relevant page is visited.

Reports

Symbiant Risk Suite contains several filterable reports which can be styled to match the look required by your company, for more details see the Symbiant Risk Suite Customisation Guide.

The reports set-up allows you to define the Header and Footer displayed on each of the reports.

This means you can very easily customise the report to display specific information that may be required for a particular set of reports for a particular audit. The header and footer content entered will be applied to all reports for all users.

The report headers and footers are entered in a powerful yet easy to use on-line HTML editor. All the basic HTML editing functions are available and should be familiar to anyone who has used a word processor. All users can generate reports of one description or another.

Click [Save] to save the changes you have made. The alterations will be applied to the next report generated.

Emails

The Symbiant Risk Suite system has several notification and reminder emails for all the key sections.

The notification emails include:

• Workshops > Assigned
• Workshops > Voting > Enabled
• Workshops > Treatment > Enabled
• Questionnaires > New
• Tracker > New Assignment
• Tracker > Status Update

The Assigned and Enabled emails are triggered when workshops are assigned to user or users are assigned to recommendations or when a workshops status changes. The update email is triggered when a manager or administrator updates a recommendation users are assigned to.

Reply email allows you to specify whether the email address of the assigner is used, that is the email address of the administrator or manager who is assigning the recommendation or whether a default email address is used. If the Managers email address is ticked, this will always be used regardless of whether a default email address is entered.

If you do not wish to allow users to reply to a real account a dummy account can be set-up, i.e. ‘noreply@ yourcompany.com’.

Subject, the title of the email message and the text displayed in the users Inbox.

Message, the body/content of the email. Special markers can be used in the message to display useful information to the user, these are:

#NAME# Name of user
#WORKSHOP# Name of the workshop
#COMPLETEBY# The date by which the process must be complete
#QUESTIONNAIRE# Questionnaire name
#TYPE# The type of questionnaire that has been issued
#REF# Risk reference number
#SUMMARY# Short issue summary
#ACTIONBY# The date by which the recommendation must be actioned
Please note, not all markers are available on all types of email, check on-line help for details of which markers can be used with which emails.

Click [Save] to save any changes you have made, the alterations will be applied to the next batch of emails sent.

The reminder emails include:

• Workshops > Voting > Reminder
• Workshops > Treatment > Reminder
• Questionnaires > Due
• Tracker > Reminder

The reminder and due emails are sent before (or on) the date the user must complete the information by.

To give the user time to login and complete the relevant information before the action by is reached the email can be sent a set number of days beforehand. The Remind field allows you to specify if the email is sent on the actual action by date only, or x number of days beforehand, the options are:

• on actual day only
• a day before
• two days before
• three days before
• a week before
• a fortnight before

Click [Save] to save any changes you have made, the alterations will be applied to the next batch of emails sent.