How to use Business Processes

[Michael Oosten1]

Hi,

I was looking into Business Processes (Policy and Compliance > Scoping > Business Process, or Risk > Scoping > Business Process) for rolling up risk & compliance to process level.

The documentation (see diagram at the bottom of the page) suggests that you can define the relationship of the process with the associated risks and controls. And that you can determine how associating the risks and controls helps to derive the risk rating of the process. How exactly does this work? The documentation (or RCI training) doesn't describe how you can accomplish this and what the best-practices are.

Typically I would create an Entity Type called Business Processes and relate my Risk Statements and Control Objectives. But the documentation seem to suggest there is another way. Does anyone know?

Thanks,

Michael

[Community Alums]

Hi @Michael Oosten1 ,

Your idea is correct!!

You are actually creating Entity Type by using a Entity filter which is eventually called from a table which comprises of your Business Application , something like this :

This is your Entity filter :

Now, you can either relate the Risk Statements and Control Objectives in this entity filter itself or at the control objective level too , something like below :

[Michael Oosten1]

Yes, thanks for your reply. And I'm well versed in Entity Types and Filters. The documentation of Business Process (not Business Application!) seems to suggest another type of usage, but I guess that's meant as a conceptual explanation.

Thanks,

Michael