Change of Residual Risk Score in Risk Assessment Methodology based on Risk Events or Control Testing or Mitigation Plan

[User480943]

Hi Community,

Currently Residual Risk Assessment  Score changes through Risk Assessment Methodology (RAM ) either as calculated or we can do Override .

a. Is there any possibility to change the Residual Risk Scoring based on the impact of a Risk Event and when the Risk Event is closed, without Re-assing the Risk through RCSA (RAM) ? Currently I dont see this option in out of the box , and I want to understand what others have done in this scenario to change the Residual Risk Rating or Risk Profile ?

b. Same Goes with Remediation /Action Plan . Currently the Residual Risk Score is Very High and based on the Action Plan or Mitigation Plan Is there any way the Residual Risk Score becomes Low after the Action Plan is closed ? I see out of the Box there is no option to change the Residual Score of the RCSA automatically after the Action plan is closed ? Again what others might have done to solve this challange ?

c. We have Control Testing performed in a different Assessment Questionnaire  and based on control Testing Results , the Score of Residual Score will change again . Does it have any impacty to change the Score of Residual Risk based on Control Testing Score Result ? 

Regards,

SB

[Naveen Kumar4 · Accepted solution]

Hi by,

We have provided Automated scripted factors and you are free to write any custom code and assessments will be recalculated based on their frequency. Automated scripted factors will suffice all of the three use cases mentioned here. Please let me know if it works for you.

Thanks,

Naveen

[Arnaud Bretz1]

Hi @Naveen Kumar4 ,

Is it possible to share with me the automated scripted factors ? The link you have attached is not referring to the original post.

Thank you very much,

Arnaud

[Francine Anders]

Thanks for trying to help me, but this method not working to me  Surge Card Info

[User480943]

Hi Francine,

You have to create the new Risk Scoring fields Like Impact and Likelihood in those Modules and then use the Automated factor to run it on schedule basis to update the score in Risk register . This way it will work out , the Problem is since its a scripted factor , I still believes it needs a maintainenece during upgrade . Let me know your point of view.