Defining Master Data for Issue Management

Risk classifications are labels and descriptions that define how your organization categorizes different levels of risk. The classifications you define show in:

• Control-based engagement risk assessment projects
  • In the Inherent Risk (Commodity) and Residual Risk fields in the Engagement Summary area of the engagement page
• Issue management projects
  • In the Residual Risk field in the Issue Details area of the issue page.

Each classification is associated with a number that reflects its risk.

• For example, you can classify a risk of 1 as Low and a risk of 5 as Critical.

You can define up to 5 classifications. If you use text labels for their names, you must also define translations for those names in all of the languages used in your site.

This table shows an example of the risk classifications data file.

You use the Import Risk Classifications data import task to define risk classifications. The task reads from the RiskClassification.csv file, which includes the following fields:

You use the Import Translations for Risk Classifications data import task to define translations for the risk classifications you defined in RiskClassification.csv. The task reads from a CSV file that includes the following fields:

Risk probabilities are indicators of how likely an issue is to actually occur on a scale from low to high. Users managing issues in control-based engagement risk assessment projects assign those issues a probability.

For example, you can define a scale with a low end of Remote and a high end of Very Likely, with values in between such as Unlikely, Possible, and Likely.

The issue form in issue management projects includes a probability question, and risk probability data defines the possible answers to that question.

You can define any number of probabilities, but keeping the number limited helps you to create a scale with easy to understand contrasts between levels so that users have a clear choice when they set the probability of an issue.

• If you use text labels for their names, you must also define translations for those names in all of the languages used in your site.

This table shows an example of the risk classifications data file.

Use the Import Risk Probabilities data import task to define risk probabilities. The task reads from the RiskProbability.csv file, which includes the following fields:

Use the Import Translations for Risk Probabilities data import task to define translations for the risk probabilities you defined in RiskSeverity.csv. The task reads from a CSV file that includes the following fields:

Risk severities are indicators of how serious or critical an issue is on a scale from low to high. Users managing issues in control-based engagement risk assessment projects assign those issues a severity.

For example, you can define a scale with a low end of Insignificant and a high end of Severe, with values in between such as Low, Medium, and High.

The issue form in issue management projects includes a question about severity, and risk severity data defines the possible answers to that question.

You can define any number of severities, but keeping the number limited helps you to create a scale with easy to understand contrasts between levels so that users have a clear choice when they set the severity of an issue.

• If you use text labels for their names, you must also define translations for those names in all of the languages used in your site.

This table shows an example of the risk severities data file.

You use the Import Risk Severities data import task to define risk severities. The task reads from the RiskSeverity.csv file, which includes the following fields:

Use the Import Translations for Risk Severities data import task to define translations for the risk severities you defined in RiskSeverity.csv. The task reads from a CSV file that includes the following fields:

Residual risk mappings assign a risk classification to each possible combination of probability and severity.

• The combination of severity and probability for an issue determines its residual risk level based on residual risk mapping master data.

This diagram illustrates an example of planning residual risk mappings.

This figure shows an example of the risk severities data file.

You use the Import Residual Risk Mappings data import task to define residual risk mappings. The task reads from the ResidualRiskMapping.csv file, which includes the following fields:

This video will explain how to use the ResidualRiskMapping.csv file to define residual risk mappings.