Replacing a Risk Assessment Methodology with a new one suggestions.

[joeyfrease]

Hi all, (and Jan 🙂 ) ,

Any suggestions for the following post publication of a RAM that is to replace existing?

I'm adding a factor / text question to the group factor of the inherent assessment section of a Risk Assessment Methodology(RAM).

The RAM has been copied along with all of the remaining components like inherent assessments etc.  The scope , group factor , the new manual factor have been added and all is well.   Simulation has worked fine.  Retirement of existing is fine, old assessments were addressed.  All is well to this point.

I am looking at all the tables where the RAM is listed as a reference in the dictionary.  

At the very least I knew that Entity Class would require a RAM update.  As would the following , at least require a review.  

sn_grc_profile_class

sn_grc_profile

sn_risk_advanced_risk_assessment_result

sn_risk_advanced_assessment_type

sn_risk_advanced_factor

We're excluding replacing the RAM when it is part of an assessment instance or anywhere it "should still be".

The question - thank you for waiting - is any other pit falls , places I've missed I might want to also address during this replacement?

well I found a rather deep pit.  It would appear that when you copy the published RAM, the copy takes the scope of the current scope and plops it in the tables application field.  Example is below.

Thanks always,

Joey

[Pulkesh Haran · Accepted solution]

Hi,

The places where you have to modify RAM reference manually are: 

sn_grc_profile_class : If any change made on this it will copied to related entities and risks.

sn_risk_advanced_risk_identification_configuration

sn_risk_definition

sn_risk_advanced_ric_ram_mapping :: Delete existing mapping and create new one

The existing records can't be modified. Create new records for these tables: 

sn_risk_advanced_risk_assessment_scheduler

sn_risk_advanced_assessment_scope

All of these places we found references to RAM: 

GRC: Advanced risk

sn_grc_profile_class

sn_grc_profile

sn_risk_advanced_assessment_scope

sn_risk_advanced_assessment_type

sn_risk_advanced_factor

sn_risk_advanced_ric_ram_mapping

sn_risk_advanced_risk_asmt_report_definition

sn_risk_advanced_risk_assessment_instance

sn_risk_advanced_risk_assessment_methodology_to_source

sn_risk_advanced_risk_assessment_methodology

sn_risk_advanced_risk_assessment_results

sn_risk_advanced_risk_assessment_scheduler

sn_risk_advanced_risk_identification_configuration

sn_risk_definition

sn_risk_risk

GRC: Privacy plugin also installled:

sn_privacy_m2m_processing_activity_high_risk_statement

sn_privacy_m2m_risk_ram_processing_activity

sn_privacy_processing_activity

Thanks

Pulkesh haran