What is Operational Risk?
The Risk Management Association defines operational risk as “the risk of loss resulting from inadequate or failed internal processes, people, and systems, or from external events.” Examples of operational risk include natural and man-made disasters, cyber-attacks, errors, fraud, and regulatory or contractual non-compliance.
Why is Bottom-Up Risk Assessment so important?
The introduction of new products and services, mergers and acquisitions, business process changes, and fraud are often viewed as risk projects to be evaluated when making decisions to move forward or enhance risk treatments. All too often, these kinds of operational project reviews are performed on an ad-hoc basis, using an unstructured and inconsistent approach. Bottom-up, project-oriented risk assessments are prone to incomplete and unreliable information. In addition, IT and business teams are often asked to collect the same assessment data via spreadsheets, Word documents, and email for different risk and compliance assessments. This manual approach results in missed project deadlines, inconsistent and inaccurate risk assessments, risk treatments, and remediation plans. Manual approaches also often inefficient and expensive, and lack an easy way to compare results of multiple assessments. Since risks cannot be identified or assessed properly, losses, incidents, or other surprises related to the project may arise at a later date. Without visibility to or accountability in addressing known risks identified through bottom-up risk assessments, resource misallocation and slow implementation in risk treatment are the typical results.
RSA Archer Bottom-Up Risk Assessment
RSA Archer Bottom-Up Risk Assessment allows you to engage your teams via targeted project risk assessments. Projects can include such things as new and changing business processes, fraud assessments, new products and services, and proposed mergers, acquisitions, and divestitures. Projects can be documented and questionnaires can be created with custom questions, as well as questions derived from RSA Archer’s extensive library of thousands of out-of-the-box questions. When risks are deemed too high, risk treatments and remediation plans can be documented and tracked through to resolution and approval.
Key features include:
- Consistent approach to identify and assess project-related risk
- Oversight and management of all risk assessments in process
- Risk treatment plans are known across all assessments and implementation plans can be monitored to completion
- Consolidated list of prioritized risk treatments and remediation plans
- Visibility into assessment progress, risk treatments and remediation activity via pre-defined reports and risk dashboards
- Named accountability for assessments and remediation plans
RSA Archer Bottom-Up Risk Assessment provides:
- Consistent approach to identify and assess project-related risk
- Oversight and management of all risk assessments in process
- Known risk treatment plans across all assessments and implementation plans that can be monitored to completion
- Consolidated list of prioritized risk treatments and remediation plans
- Visibility into assessment progress, risk treatments and remediation activity via pre-defined reports and risk dashboards
- Accountability for risk assessment and remediation activities
Today, organizations are faced with complex and fast moving operational risk challenges. Tracking changing business activities is a core best practice in Operational Risk Management. RSA Archer Bottom-Up Risk Assessment is a key element of an effective Operational and Integrated Risk Management program to assess risk associated with changing business activities. Stressing the agility and flexibility needed by today’s modern organizations, integrated risk management brings together the various domains of risk across business activities (horizontally), connecting the activities to the strategies and objectives of the organization on an aggregated basis (vertically). This approach to risk management provides leaders with the most holistic understanding of risk facing their organization so they can make truly informed decisions about where to deploy limited capital and human resources to produce optimized returns for the organization while maximizing the likelihood of achieving the organization’s objectives.
As your organization drives business growth, your risk management program must evolve and manage risk more holistically, with more agility and integration than before. Effectively performing Bottom-Up risk assessments is one ingredient to demonstrating real progress and improvement in decreasing business risk. RSA Archer can help your organization better understand and manage risk assessments on one configurable, integrated software platform. With RSA Archer solutions, organizations can efficiently implement risk management processes using industry standards and best practices and significantly improve their business risk management maturity.
For more information, visit RSA.com or read the Datasheet.
