Risk roll up at entity hierarchy level

[rajeeshraj]

The entity class is set up as Company -->Business Unit-->Division-->Department.

All the entities of the 'Department' entity class are downstream of entities of the 'Division' entity class, etc.

How does the risk roll up from the entity of 'Department' to the entity of the 'Division entity class up to the entity of the 'Company' entity class?

Out of the box, if we set upstream and downstream entities, we have a rollup of risk only to the entity level. In this example, at the 'Department' entity level, the rollup is of all risks associated with the 'Application' entity.

[Community Alums]

Hi @rajeeshraj ,

Risk Rollup happens at Entity Level not based on Class Hierarchy .

It happens at entity level and Rolls up to the upstream entity relationship that we build.

Class hierarchy can be setup in GRC workbench. Entity Upstream and Downstream relationships are set up at the entity level.

[rajeeshraj]

Agree that the Entity Upstream and Downstream relationships are set up at the entity level.

The question is more around how risk roll-up.

As you mentioned, if we set upstream and downstream entities, the risk score on each entity is the sum of all risks associated with that entity.

Does the child entity's risk score (not risk itself) roll up to the upstream entity? Or does it have to be built using reporting?

[Community Alums · Accepted solution]

Hi @rajeeshraj ,

The child entity's risk score will also roll up to the upstream entity by default once you have set the upstream.