Who is this article for?

Users who need to plan Risk Assessments.

No special access or permissions are required.

Each Entity-Process will have a Planning Risk Assessment for each of the associated Planning Risks, which will lead to ratings for all the Auditable Entities in the audit universe that can then be analysed in the Planning Risk Exposure screen.

1. Understanding Planning Risk Assessments

Each Entity-Process will have a Planning Risk Assessment for each of the associated Planning Risks. Planning Risk assessments will lead to ratings for all the Auditable Entities in the audit universe, which can then be analysed in the Planning Risk Exposure screen.

Note: You can specify on each planning risk an Entity Type and Process Type to refine the number of Planning Risk Assessments created.

The example above shows Entity-Processes:

• Alexandria Head Office - General Management
• Alexandria Head Office - Legal & Secretarial
• Alexandria Head Office - Treasury

Each of the Entity-Processes is associated with the same Planning Risks:

• Change
• Environmental Factors
• Fraud
• Size
• Reliance on IT Systems
• Sensitivity
• Security

This means that in this example, each Entity-Process will have seven Planning Risk assessments.

2. Configuring Entity-Process properties

The Execution section contains the following properties:

• Owner (Set via a Person dialogue window)
• Budget Effort (copied from the Entity Process)
• Score (calculated read only field)
• Rating (calculated read only field)
• Sign Off State - the sign off state shows whether the Entity-Process Period is open/completed/approved

3. Configuring Planning Risk Assessment properties

The Execution section contains the following properties:

• Owner – The user responsible for giving the Planning Risk Assessment a Rating, where Owner is taken from the Entity Owner field, NOT the Entity Process Owner field
• Scope State - (In or Out of scope)
• Rating – The Risk Score of the Planning Risk Assessment
• Comments – Any needed comments

The Policy section contains the following properties:

• Description
• Guidance

4. Using navigators to filter data

The Planning Risks Assessment screen has two navigators that can be used to filter the data shown on the screen:

• The first navigator allows the data to be filtered by Org Unit or Entity
• The second navigator allows the data to be filtered by Process Area or Process

5. Setting Planning Risk Assessment Ratings

Each Planning Risks Assessment of an Entity-Process must have a Rating before it can be marked as completed.

Each rating has an associated value. These ratings and their associated values can be configured within Admin > Segmentations > Planning Risks Assessment Ratings.

Giving a Planning Risk Assessment a rating will cause the rating and associated score to be displayed on the data grid.

The Entity-Process rating and score will not be calculated until all its Planning Risks Assessments have been rated.

6. Assessing planning risks in bulk

It is possible to assess planning risks in bulk through the multi-edit functionality.

1. Highlight the planning risk assessments you wish to update.
2. Open the properties panel.
3. Click the button to edit them.
4. Enter the rating.
5. Save your changes.

Important: Each Entity could have a different Matrix Configuration configured and a warning will be displayed if the bulk operation is not valid.

7. Calculating Entity-Process Risk Scores

The Entity-Process score is set by default to be the average (may be changed within System Settings) of the associated planning risks assessment scores.

The example above has three planning risks with the following scores:

• 50
• 100
• 0

Therefore the Entity-Process score = (50 + 100+ 0) /3

Entity-Process score = 50

A score of 50 gives the Entity-Process the rating of Medium because this is the rating associated with that value range in Admin > Segmentations > Planning Risks Ratings.

In the example above the score value ranges can be seen.

Cells will fall into a given Planning Risk Rating if their total score is greater than its Value but less than the Value of the next Rating.

8. Applying weighting to Entity-Process scores

For an Entity with a weighting the Entity-Process Planning Risk Score = Average of Planning Risk Assessment Scores x Weighting.

9. Managing sign off for Entity-Processes

Entity-Processes within a Planning Period follow the same life cycle as other objects within Pentana (Open, Completed and Approved).

An Entity-Process can be marked as completed once all the associated planning risk assessments have been assessed.

The final state of an Entity-Process is approved.

10. Adding attachments

Attachments can be added to both the Planning Risks Assessment and the Entity-Process. This can be achieved through either the relevant command on the Ribbon, through the right click menu or by dragging and dropping the desired attachment onto the data grid.

11. Switching between display modes

The Planning Risk Assessments Screen has two display options:

• Entity-Process Periods
• Planning Risk Assessments

The Entity-Process Periods display mode will show each Entity-Process on a separate row. The associated Planning Risks Assessments can be accessed through the available child grid.

The Planning Risks Assessments display mode will show each Planning Risk Assessment on a separate row.

12. Getting prior assessments from previous Planning Periods

It is possible to get assessments from a previous Planning Period. This can be achieved either through the relevant command on the Ribbon or the right click menu.

1. Select the command to open a window with a list of Planning Periods to choose from.

2. Select the Planning Period you wish to get prior assessments from (Include Attachments and Override Assessments are optional).
3. Click the right arrow.

The next screen is a matrix of the Audit Universe.

4. Select the Entity-Processes to get prior assessments from.
5. Click the Ok button.

• Prior assessments will be imported where there is no current assessment if the Override Assessment tick box is left un-ticked
• Ticking the box will cause all current assessments to be overwritten with prior assessments