IBM OpenPages GRC Platform Version Policy and Compliance Management Module Overview

Transcription

1 IBM OpenPages GRC Platform Version Policy and Compliance Management Module Oeriew

2 Note Before using this information and the product it supports, read the information in Notices on page 43. Product Information This document applies to IBM OpenPages GRC Platform Version and may also apply to subsequent releases. Licensed Materials - Property of IBM Corporation. Copyright IBM Corporation, 2003, US Goernment Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

3 Contents Document Release and Update Information Chapter 1. Introduction Module Description Approaches to Policy Management Object Type Licensing Chapter 2. Object Types Object Types Enabled by Default Object Types Disabled by Default Subcomponents Chapter 3. Computed Fields Chapter 4. Helpers Policy Viewers Compare Policy View Policy Unlock Helper Publishing Batch Notification Policy Awareness View Attestation Creation Report Helper Chapter 5. Notifications Issue and Action Bulletin notification KRI Reminder notification KRI Breach notification KPI Reminder notification KPI Breach notification Chapter 6. Reports PCM-specific Reports Reports Shared with Other Modules Chapter 7. Triggers PCM-Specific Triggers Triggers Shared with Other Modules Issue Management and Remediation trigger KRI Lifecycle trigger KPI Lifecycle trigger Risk and Control Self-assessments triggers Visualization triggers Chapter 8. Profiles OpenPages PCM Master Profile Home Page Filtered Lists Actiity Views Grid Views Chapter 9. Role Templates Notices Index iii

4 i IBM OpenPages GRC Platform Version 7.0.0: Policy and Compliance Management Module Oeriew

5 Document Release and Update Information This topic lists information about this document and where updates to this document can be found. Document Release Information Software Version: Document Published: December, 2013 Document Updates Supplemental documentation is aailable on the web. Go to the IBM OpenPages GRC Platform Information Center ( 7r0m0/index.jsp).

6 i IBM OpenPages GRC Platform Version 7.0.0: Policy and Compliance Management Module Oeriew

7 Chapter 1. Introduction Module Description Use this guide with the IBM OpenPages Policy and Compliance Management module. Finding information To find IBM OpenPages GRC Platform product documentation on the web, including all translated documentation, access the IBM OpenPages GRC Platform Information Center ( Release Notes are published directly to the Information Center, and include links to the latest technotes and APARs. Accessibility features Accessibility features help users who hae a physical disability, such as restricted mobility or limited ision, to use information technology products. IBM HTML documentation has accessibility features. PDF documents are supplemental and, as such, include no added accessibility features. IBM OpenPages Policy and Compliance Management, an enterprise Compliance Management software solution, reduces the cost, complexity, and cumbersome nature of compliance with multiple regulatory mandates and corporate policies. IBM OpenPages Policy and Compliance Management enables companies to manage and monitor compliance actiities through a full set of integrated functions that includes: Regulatory libraries and change management Risk and control assessments Policy management, including policy creation, reiew and approal, and policy awareness Control Testing and Issue Remediation Regulator interaction management Incident tracking Key performance indicators Reporting, monitoring, and analytics Approaches to Policy Management The IBM OpenPages Policy and Compliance Management module offers seeral approaches to managing content for policies and procedures. IBM OpenPages Policy and Compliance Management supports the following approaches to policy management: 1

8 Object Type Licensing Datacentric Policy attributes are stored as metadata in the Policy object. Policy and Procedure content is created, stored, edited, and reiewed in OpenPages through Policy Viewers. Red-lined track changes within draft iterations are not supported. Docucentric Policy attributes are stored as metadata in the Policy object. Policy and Procedure content is created outside of OpenPages and the entire document is attached to the Policy Object. Policy and Procedure content is neer imported or stored in OpenPages. Hybrid Policy attributes are stored as metadata in the Policy object. Policy and Procedure content is created and edited in Microsoft Word documents then imported and stored in OpenPages. Natie Word Track Changes functionality is used for tracking red-line changes within draft iterations. For the IBM OpenPages Policy and Compliance module, you are licensed to use the object types listed in Chapter 2, Object Types, on page 3. Use of any other object types is prohibited without prior written approal from IBM. 2 IBM OpenPages GRC Platform Version 7.0.0: Policy and Compliance Management Module Oeriew

9 Chapter 2. Object Types The IBM OpenPages Policy and Compliance Management module includes arious object types that are enabled or disabled by default, and subcomponents. Object Types Enabled by Default The following object types are aailable in the default IBM OpenPages Policy and Compliance Management configuration and are enabled by default. Table 1. Object types enabled by default Object type label Description Business Entity Business Entity object types are abstract representations of your business structure. A Business Entity object can contain Sub-Entity objects (such as departments, business units, or geographic locations). The entity structure that you create depends on your business needs. For example, you could create a parent entity for your business headquarters then a subentity for each location or department. You may also want to represent both a legal entity structure and a business entity structure. Business Entity objects are also used to organize library data such as risk and control libraries, or regulatory content (for example, laws, regulations, and standards). Process Sub-Process Risk Since the structure of your business entities will greatly impact the type and quality of the information that can be extracted from the application, we strongly recommend that you work with your IBM OpenPages consultant when setting up your business entity hierarchy. Process object types represent the major end-to-end business actiities within a business entity that are subject to risk. Process objects typically reside in areas such as financial reporting, compliance and information security. A Sub-Process object type is a component of a Process object. It is used to decompose processes into smaller granularity units for assessment purposes. Risk object types represent potential liabilities. Risk objects can be associated with, for example, business processes, business entities, or compliance with a particular mandate. Each Risk object has one or more Control objects associated with it that proide safeguards against the risk, and help mitigate any consequences that may result from the risk. You can use the Risk object to categorize risks; capture the frequency, rating, and seerity of inherent and residual risk data; and iew reports that help identify your top risk items. 3

10 Table 1. Object types enabled by default (continued) Object type label Description Control Control object types typically represent policies and procedures (procedures are actions that implement the policies) to help ensure that risk mitigation responses are carried out. Once you identify the risks in your practices, you can then establish controls (such as approals, authorizations, erifications) that remoe, limit, or transfer these potential risks. Test Plan Test Result Risk Assessment KPI, KPI Value Incident Waier Mandate Controls should be designed to proide either preention or detection of risks. Control objects are usually associated with Test objects that ensure a control is effectie. You can determine the operating effectieness of a control by conducting one or more detailed tests of a control and then documenting the results. Test Plan object types contain descriptions of the mechanisms used to determine the effectieness of a control. A Test Result object type is typically used to capture the information obtained from running a Test Plan. Risk assessment object types gie you the ability to ealuate and report on potential liabilities for a set of business entities or processes. You can use the Risk Assessment object which contains the names of the assessor and reiewer, the time frames for the assessment, and the status of the assessment to manage your risk self-assessment process. KPI object types are components of the risk monitoring process and are used to proide leading or lagging indicators for potential risk conditions. Each instance of a KPI within the organization can hae unique target and threshold limits. Incident object types are used to capture, track, and manage eents that occur in the organization and IT Operating Enironment. Incident objects are typically stored under the Business Entity or IT Resource object where the eent occurred and associated secondarily to an impacted Mandate or Policy object. Incident objects can be created manually or through integration with other systems (that is, IT monitoring system), and are commonly of type Regulatory Compliance, Legal Compliance, Information Security, or IT. Incident objects can be a child of Business Entity, Mandate, Sub-Mandate, Requirement, Policy, Risk, Resource, and Risk Sub-Entity objects. If IBM OpenPages ORM is also installed, Incident objects can also the parent of Loss Eent objects. Waier object types gie you the ability to document, process, and manage the lifecycle of exceptions to Corporate Policies, InfoSec Policies, IT Policies, or Regulatory Compliance Requirements. Waier objects can be associated to Business Entities, Policies, Procedures, Requirements, Risks, Controls, Baselines, and Resources objects. Mandate objects represent external items with which organizations need to comply, such as laws, regulations, and standards. By default, the standard configuration directly supports content proided by Deloitte and UCF, and can be adapted to support content from other endors. Typically, Mandates are represented in a library Business Entity structure, and are not replicated throughout the system. 4 IBM OpenPages GRC Platform Version 7.0.0: Policy and Compliance Management Module Oeriew

11 Table 1. Object types enabled by default (continued) Object type label Description Sub-Mandate Sub-Mandate object types represent external (or internal) subitems with which the organization needs to comply. By default, the standard configuration directly supports content proided by Deloitte and UCF, and the configuration can be adapted to support content from other endors. Typically, Sub-Mandate objects are represented in a library Business Entity structure, and are not replicated throughout the system. Although the Sub-Mandate object is recursie, Deloitte and UCF content use exactly one leel of Sub-Mandate. Requirement Requirement object types represent the normalized "things you need to accomplish" to comply with all of their associated Sub-Mandate objects. Requirement objects accomplish two primary purposes: they translate the often difficult and wordy legal jargon of Mandates/Sub-Mandates into plain English, and they use the commonality across multiple Sub-Mandates. For example, there can be many Sub-Mandates across numerous Mandates that require the use of strong passwords. A single Requirement object can document the details for strong passwords. By complying with this single Requirement, IT can satisfy many Mandates and/ or Sub-Mandates. Regulation Applicability Regulatory Change Regulatory Task Default configuration directly supports content proided by Deloitte and UCF, and can be adapted to support content from other endors. Typically, Requirement objects are represented in a library Business Entity structure, and are not replicated throughout the system. The Regulation Applicability object is the child of Business Entity and parent of Mandate. It is typically part of the organizational business hierarchy, and is used to assess and track the regulatory impact of a Mandate object in the library on a Business Entity. The Regulatory Change object is part of the regulatory change management capability. It supports the ability to: track regulatory changes (change or guidance to an existing regulation or a new regulatory requirement), assess the impact of a change on the organization, communicate the change internally to the appropriate people, and drie internal processes in response to the change. Regulatory Change objects are typically part of the library Business Entity, and are associated directly to the Mandate object that changed. It then has multiple Regulatory Task objects associated to it; one for each Business Entity impacted by the respectie Mandate. The Regulatory Task object is part of the regulatory change management capability. It facilitates the change management process associated with a regulatory change. A Regulatory Task object is created in the organizational business hierarchy, and assigned to an indiidual in each of the Business Entities impacted by the Mandate object that was changed. The object is then used to track and monitor if an action is required as a result of the change (for example, reise policy, control assessment, training), and the progress of the action. Chapter 2. Object Types 5

12 Table 1. Object types enabled by default (continued) Object type label Description Policy Policies represent internal guidelines generally adopted by the Board of Directors or senior goernance body within an organization. The text of a Policy can either be stored in standardized fields on the Policy object or as an attachment to the Policy object. Policy objects typically hae a distinct lifecycle from Draft to Published to Expired, and a reiew and approal process. Draft Policy objects typically reside in the organizational business hierarchy, while Published and Expired Policy objects typically reside in reference library entities. Policy objects are also often mapped to applicable Mandate objects in the library to which they relate. Preference Group, Preference The Preference Group object type is used for grouping Preference object instances together. Without this grouping object, each Preference object instance would need to be associated separately to each of the releant Business Entities. The group object helps to minimize the associated maintenance. Procedure Policy Reiew Comment Campaign Employee The Preference object type is a child of Business Entity, and is used for holding ariable alues that can drie reports, workflows, and computed fields. The Preference object has entity-specific ariable alues that enable different behaior for the same workflows such as to determine the behaior for reiew and approal workflows. That is, who the appropriate users are for each leel of reiew and approal, and what the thresholds are for determining how many leels of reiew and approal are required. Procedures represent the 'what', 'where', 'when', and how of how policies are implemented in an organization. The text of procedures is typically stored in the fields on the Procedure object. Typically, Procedure objects are represented as children of a Policy object and reside in the same entity structure as its parent Policy object. Policy Reiew Comment objects support and facilitate the reiew and approal process of Policy and Procedure objects by subject matter experts and compliance personnel. The Campaign object is part of the policy awareness capability and is used to manage the project management aspects of an awareness campaign. It is also used to define the requirements or criteria that identify which employees need to read and attest to each policy, and is done through a series of fields. Campaign objects are typically created in the published policy hierarchy. The Employee object is part of the policy awareness capability. You can use it to capture information about indiidual employees such as name, title, , region, department, status. Information from the employee profile is then matched against the attestation requirements defined on a Campaign object to determine which employees need to attest to each policy. Employee data is typically deried from an HR system export, loaded using Online FastMap, and resides in the reference Employee Business Entity. It is strongly recommended that the Employee Name field matches the user's user name. 6 IBM OpenPages GRC Platform Version 7.0.0: Policy and Compliance Management Module Oeriew

13 Table 1. Object types enabled by default (continued) Object type label Description Attestation The Attestation object is part of the policy awareness capability. You can use it to capture an employee's affirmation that they read and understood a policy. The primary parent of the Attestation object is the Employee object, and the secondary parent is the associated Campaign object. Regulator The Regulator object is part of the regulator interaction management capability. An organization can use it to create a single inentory of all regulators with which they interact. Regulator objects are typically created in a reference library Business Entity. The object is a child of Business Entity and can be associated to Mandates and Regulator Interactions objects. Regulator Interaction The Regulator Interaction object is part of the regulator interaction management capability. You can use it to manage the interactions, communication, internal work, reiew, and approals associated with external regulators such as inquiries, submissions, filings, exams and audits. For complex interactions such as exams and audits, customers can use a three-tier object structure (Regulator Interaction, RI Category, and RI Request) to manage and track: the oerall interaction, each section of the interaction, and the indiidual requests. For simpler requests and inquiries, customers can use the Regulator Interaction object by itself to manage the request details and response details. RI Category The RI Category object is part of the regulator interaction management capability. It is used as the middle tier of the three-tier object model (Regulator Interaction, RI Category, and RI Request). The RI Category object is used to organize and track the progress of indiidual sections or categories of a complex interaction such as an exam or audit. RI Request The RI Request object is part of the Regulator Interaction Management capability. It is used as the bottom tier of the three-tier object model (Regulator Interaction, RI Category, and RI Request). You can use the RI Request object to organize and track: indiidual requests, reiews, and approals of pre-work and on-site tasks as part of a complex interaction such as an exam or audit. Questionnaire, Section, and Question Signature Questionnaire, Section, and Question are three objects that are used together to implement questionnaires. A signature generally indicates agreement that the object meets your approal. It has no enforcement powers, and does not preent the item from being modified after approal has been gien. An object with a signature has a signature icon next to the signer's name on the Signatures tab. Depending on your system configuration, signatures (with or without associated locks) can be applied to an object in the following ways: Manually from the detail page of an object. Automatically through a workflow task. Some combination of both automatic and manual. If signature locks are configured on your system, when you sign off on an object, the object and all its associated child objects are locked and cannot be modified until you either reoke your signature or an administrator unlocks the object. Chapter 2. Object Types 7

14 Table 1. Object types enabled by default (continued) Object type label Description Issue, Action Item Although issues typically result from areas where internal controls are not properly implemented or designed, you can use the Issue object type to document a concern associated with any object type. File Link Process Diagram Data Input, Data Output An issue is resoled through one or more action items. You can use an Action Item object or a series of related Action Item objects to form an action plan. Each Action Item object can be assigned to a user for resolution, and progress can be tracked from the detail page of the parent Issue object. Once all Action Item objects for an Issue are complete (an assignee sets the alue to 100%), you can close the Issue object. The File object type is used to embed a reference to a file (such as a document, flow chart or spreadsheet) in the OpenPages system, and associate it to one or more releant objects. The Link object type is used to embed a reference to a URL in the IBM OpenPages system, and associate it to one or more releant objects. A Process Diagram is a child object of the Process and can hae many diagrams per process. It is used to store the sequence of sub-processes or actiities within a process with associated Risks and Controls along with any annotations such as decision nodes. All attributes of the Business Process isualization are stored in the Process Diagram object. The Data Input Object and Data Output Object are child objects of the Process and can hae associations only to existing Risks. They represent elements of a flow to depict an Input into the Business Flow or an Output from arious actiities within a process, such as running a report or updating a CRM system or getting an external data source feed. 8 IBM OpenPages GRC Platform Version 7.0.0: Policy and Compliance Management Module Oeriew

15 Object Types Disabled by Default The following object types are aailable in the default IBM OpenPages Policy and Compliance Management configuration and are disabled by default. Table 2. Object types disabled by default Object type label Control Objectie Description A Control Objectie is an assessment object type that helps define the risk categories for a process or subprocess. For each process or subprocess, an organization sets the control objecties. Control objecties define the COSO compliance categories that the controls associated with the risks are intended to mitigate. For example, Control Objectie objects can be classified into one or more categories such as Compliance, Financial Reporting, Strategic, Operations, or Unknown. Milestone, Milestone Action Item KRI, KRI Value Once a control objectie is identified, the Risk objects associated to a Control Objectie object can then be identified and defined. In most cases, each Control Objectie object has one Risk object that is associated with it. Howeer, Control Objecties can hae more than one Risk that is associated with them, so they are separated into their own object type. A Milestone object type represents a significant point in the deelopment of your project. You can tie Milestone objects to specific dates, or use them to signify the completion of a portion of the entire project. Milestone objects can contain other Milestones or Milestone Action Item objects. You cannot associate a Milestone object with other objects in the object hierarchy. A Milestone Action Item object type is a specific objectie that must be completed to reach a milestone. In general, all Milestone Action Item objects that are associated with a Milestone object must be completed to reach a milestone. When you are assigned a Milestone Action Item object, it is displayed (if configured) in the My Milestone Action Items section of your My Work tab. KRI (Key Risk Indicator) object types are components of the risk monitoring process and are used to proide leading or lagging indicators for potential risk conditions. Each instance of a KRI object within the organization can hae unique target and threshold limits. Chapter 2. Object Types 9

16 Table 2. Object types disabled by default (continued) Object type label Description Risk Eal Risk Eal (Ealuation) object types are children of Risk objects and are used to capture risk measurement alues for trending purposes. When the reporting periods do not align with the risk ealuation cycles, you can use Risk Eal objects to capture multiple ealuation cycles within a single reporting period. Control Eal Control Eal (Ealuation) object types are similar to Risk Eal objects except that they are instantiated as children of Control objects. Control Eal objects store control assessment data. Risk Assessment Eal Risk Assessment Eal (Ealuation) object types are similar to Risk Ealuation objects except that they are instantiated as children of Risk Assessment objects. Risk Assessment Eal objects store risk assessment data. Process Eal Process Ealuation objects are children of Process objects and they are used to capture process measurement alues for trending purposes. When the reporting periods do not align with the ealuation cycles, you can use Process Eal objects to capture multiple ealuation cycles within a single reporting period. Subcomponents IBM OpenPages GRC Platform modules consist of seeral subcomponents, which are groups of object types that support a logical function within a module. The following tables list the subcomponents for the IBM OpenPages Policy and Compliance Management module. Table 3. Subcomponents shared with other modules Subcomponent Object Types Organization Business Entity Preference Preference Group, Preference Risk Assessment Risk Assessment, Risk Assessment Eal Process Process, Process Eal, Sub-Process, Control Objectie Risk Risk, Risk Eal Control Control, Control Eal Test Test Plan, Test Result Issue Issue, Action Item Questionnaire Questionnaire, Section, Question Milestone Milestone, Milestone Action Item KRI KRI, KRI Value 10 IBM OpenPages GRC Platform Version 7.0.0: Policy and Compliance Management Module Oeriew

17 Table 3. Subcomponents shared with other modules (continued) Subcomponent KPI Regulatory Library Incident Waier Visualization Object Types KPI, KPI Value Mandate, Sub-Mandate, Requirement Incident Waier Process Diagram, Data Input, Data Output Table 4. PCM-specific subcomponents Subcomponent Policy Policy Attestation Campaign Regulator Interaction Regulatory Change Object Types Policy, Procedure, Policy Reiew Comment Policy, Procedure, Attestation Campaign, Employee, Attestation Regulator Interaction, Regulator, RI Category, RI Request Regulatory Change, Regulation Applicability, Regulatory Task In addition to the subcomponents listed in the tables, the following object types are included in each module and can be accessed by any authorized user: Signature File Link Chapter 2. Object Types 11

18 12 IBM OpenPages GRC Platform Version 7.0.0: Policy and Compliance Management Module Oeriew

19 Chapter 3. Computed Fields The IBM OpenPages Policy and Compliance Management module does not include any computed fields by default. A computed field is a read-only field whose alue is deried from the alues of other fields. IBM OpenPages Policy and Compliance Management uses the capability introduced in IBM OpenPages GRC Platform to launch helpers from URL fields. The computed fields that launch helper applications in IBM OpenPages Policy and Compliance Management are implemented as URL fields and are described as follows. Table 5. Computed fields that launch helper applications Object Type Label Field Group Name Field Name Label Description Attestation OPSS-Attest Policy Attestation Creates a link that launches the Policy Awareness View helper. Policy OPSS-Pol Modify Policy Creates a link that launches the Policy Editor helper. Policy OPSS-Pol View Policy Creates a link that launches the Policy Viewer helper. Policy OPSS-Pol Open Policy for New Reision Cycle Policy Reiew Comment Re-Open Policy for Additional Changes Creates a link that launches the Policy Unlock helper. OPSS-PolReComm Reiew Policy Creates a link that launches the Policy Reiew View helper. 13

20 14 IBM OpenPages GRC Platform Version 7.0.0: Policy and Compliance Management Module Oeriew

21 Chapter 4. Helpers Policy Viewers Compare Policy View The IBM OpenPages Policy and Compliance Management module includes seeral application helpers by default. See the IBM OpenPages PCM Module Details documentation for more information about these helpers. A series of Policy Viewers facilitate the process of creating, editing, reiewing and approing policies and procedures. It aggregates multiple sections of a policy and associated procedures into a single narratie iew for editing, reiewing and approing, while allowing customers to maintain standardization on a Policy template. This helper has the following iews: Modify Policy Opened from a Policy object, the Modify Policy is an editable iew that allows a policy author and owner to create and edit a Policy object and its associated Procedures. The Modify Policy iewer is only used as part of the Datacentric approach to Policy Management. View Policy Opened from a Policy object, the View Policy is a read-only iew that allows users to see a policy and its procedures in a formatted, narratie iew (Datacentric and Hybrid approach) or from a Policy Attachment link (Docucentric approach). Reiew Policy Opened from a Policy Reiew Comment object, Reiew Policy is a role-based iew that facilitates the reiew and approal process. In addition to displaying the Policy and Procedure objects, or the Policy Attachment link, it includes the Policy Reiew Comment object that allow reiewers and approers to submit feedback by either editing the Policy object directly or using the Comment form. Reiewers are presented with either an editable or read-only iew of the policy and its procedures, depending on the parameter set in the IBM OpenPages application on the Settings page. Approers are presented with a read-only iew of the policy. IBM OpenPages or the customer can configure this component to behae as appropriate for the customers' methodology using settings and application text settings. The Compare Policy View enables users to iew red-lined differences from one ersion of a policy to another. For example, a user can isually see the differences between a current draft of a policy and the published policy, or past expired ersions. The Compare Policy View is used with the Datacentric and Hybrid approaches. IBM OpenPages or the customer can configure this component to behae as appropriate for the customers' methodology using settings and application text settings. 15

22 Policy Unlock Helper Publishing Batch Notification The Policy Unlock Helper is opened from the Policy object once the policy has moed into the reiew and approal phase. The Policy Unlock Helper unlocks and readies the Policy object and its components (Procedures, Attachments, Policy Reiew Comments) for reision. The Policy Unlock Helper supports all three policy approaches: Datacentric, Docucentric, and Hybrid. The Policy Unlock Helper supports two use cases: Reopening a Policy object for additional changes within a reiew cycle: Sets the Approal Status back to In Reision. Unlocks any locked objects or attachments needed during the reision process. Updates the ersion number. Opening a Policy for a new reision cycle: Sets the Approal Status back to In Reision. Unlocks the Policy object and its components (such as Procedures, Attachments). Resets and clears fields such as Publishing Date, Publishing Status, Next Reiew Date. Updates the ersion number. Deletes or clears Policy Reiew Comment objects. Sets a flag on the corresponding published policy signifying that the draft is In Reision. IBM OpenPages or the customer can configure this component to behae as appropriate for the customers' methodology by using settings and application text settings. The Publishing Batch Notification helper facilitates the process of promoting an approed draft policy to the published library, and moing the current published ersion to the expired library. It also supports retiring a policy by moing the published policy to the published library and deleting the draft. You can use the Publishing Batch Notification helper with the Datacentric, Docucentric, and Hybrid policy approaches. The Publishing Batch Notification helper is intended to run on a scheduled basis and performs the following. Updates Draft Policy: Sets fields on draft policy such as Approal Status, Published Date, and Publishing Status Updates ersion number according to significance of policy change. Promotes a published Policy object to the expired library: Renames the Policy object (appends Expired V#). Sets Policy Location to Expired and the expiration date. Maintains approals and associations with objects such as Entities, Mandates, and so forth. 16 IBM OpenPages GRC Platform Version 7.0.0: Policy and Compliance Management Module Oeriew

23 Remoes hybrid policy attachments. Promotes a draft Policy object to the published library: Sets Policy Location to Published. Maintains approals and associations with objects such as Entities, Mandates, and so forth. Maintains existing object associations (that is, Risk Assessment) ona published Policy object. Send s upon successful publishing. Policy Awareness View IBM OpenPages or the customer can configure this component to behae as appropriate for the customers' methodology by using settings and application text settings. Policy Awareness View is an intuitie iew that allows employees (high olume, low touch users) to easily read a policy and its associated procedures in a narratie format, and then attest to haing read and understood the policy. The Policy Awareness View helper: Displays the Policy and its Procedure objects in a single read-only, narratie form with the look and feel of a corporate policy. Enables employees to attest to the policy with a single click and no naigation. Enables employees to request an exception to the policy attestation requirement. IBM OpenPages or the customer can configure this component to behae as appropriate for the customers' methodology by using registry and application text settings Attestation Creation Report Helper The Attestation Creation Report helper is a scheduled notification. It can also be run from the Reporting menu (under Attestation Reports menu). This notification report supports the Policy Awareness capability. It is intended to run on a scheduled basis and does the following: Finds all Campaign objects with a status of Ready to Start associated to published policies. Finds all actie employees that match the same attestation requirements criteria defined on the Campaign object. Creates an Attestation record for each matching employee for that policy campaign. Dries the Attestation record to the employee s home page by using the configured Home page filtered list. Sends each employee an notification to alerts them that an attestation is due. Chapter 4. Helpers 17

24 18 IBM OpenPages GRC Platform Version 7.0.0: Policy and Compliance Management Module Oeriew

25 Chapter 5. Notifications Notifications are notifications sent to owners of a process as a reminder to act. These notifications can occur at different stages of a process or as a final step in a trigger. All notifications that are sent from IBM OpenPages PCM use the following sender address. Configure the address and serer settings. /OpenPages/Solutions/ORM/ /From - the sender address that is used to send notifications /OpenPages/Solutions/ORM/ /From Name - configure this item to identify the sender name that is used by notifications /OpenPages/Common/ /Mail Serer - configure this item to identify the serer that is used to send notifications Notifications are part of the KRI lifecycle, the KPI lifecycle, and the Issue Management and Remediation process. Issue and Action Bulletin notification During the closedown phase of the Issue Management and Remediation (IMR) process, an Issue and Action Bulletin is sent as an notification to the users. The bulletin highlights important areas such as oerdue issues and Actions that are due for closure. The administrator can set the frequency of this notification by using the Issue Management and Remediation (IMR) bulletin. When the Issue is defined, its status is Open and the user must enter a alue in the Current due date field. The due date is copied to a read-only field that contains the original due date. When the user creates an Issue, the Issue Owner (who might not be the same person who created the Issue) receies an notification. The Issue Owner must record the appropriate actions to resole an identified Issue. The following data is captured in an Action Item: Description Assignee Start Date Due Date Actual Closure date Status (Read Only) A comment field to record the latest updates The Issue Owner receies an that summarizes the Actions that must be approed for closure. The owner can either Accept Closure or Reject Closure. When Actions are completed, the Issue Owner must reiew the Issue and update the status to Closed. If any child actions are Open or Awaiting Approal, the Issue Owner cannot close the issue. Users receie notifications through the consolidated Issue and Action bulletins. The bulletin consolidates the following information in an 19

26 Issues Assigned to the recipient in the past number days Actions Assigned to recipient in the past number days Issues due for Closure in the next number days Actions due for Closure in the next number days Oerdue Issues Oerdue Actions Actions awaiting closure approal KRI Reminder notification KRI Breach notification KPI Reminder notification The KRI Reminder notification is an sent to the KRI owner that contains a list of all KRI Values that the owner or recipient is required to capture in the next seen days. After the Risk Owner defines the Key Risk Indicator (KRI), the IBM OpenPages system determines whether it must generate a KRI Value object as a child of the KRI. If the KRI is set as Actie, the KRI helper generates the alues. If the KRI is set as Inactie, a batch utility sets up the KRI Value object as a placeholder with a status of Awaiting collection. The administrator can run the KRI Value utility when necessary, for example, when the automatically scheduled job fails to run. The utility creates the KRI Values with details, such as ID, Description, Expected Capture date, KRI Capturer, and KRI Owner. A notification that requests the KRI Capturer enters a KRI alue is presented in one of the following ways: Weekly notifications, which instruct the user to log in to IBM OpenPages. Based on the status of the KRI Value (Awaiting Collection) and the KRI Capturer (logged-in user), the KRI Value is shown on the user's home page. The notification that is sent to the KRI owner contains a list of KRIs that hae the following characteristics: An expected collection date that is less than (TODAY + 7) A KRI status that is set to Awaiting Collection. The KRI Breach notification sends an to the Risk Owner when a KRI breach status changes from Green to Red or from Amber to Red. The KRI Breach notification is started by the KRI Lifecycle trigger. The notification contains a link to the KRI that is in breach and adises the Risk Owner to reiew the breach and take appropriate actions. The KPI Reminder notification is an sent to the KPI owner that contains a list of all KPI Values that the owner or recipient is required to capture in the next seen days. After the Risk Owner defines the Key Performance Indicator (KPI), the IBM OpenPages system determines whether it must generate a KPI Value object as a 20 IBM OpenPages GRC Platform Version 7.0.0: Policy and Compliance Management Module Oeriew

27 KPI Breach notification child object of the KPI. If the KPI is set as Actie, the KPI helper generates the alues. If the KPI is set as Inactie, a batch utility sets up the KPI Value object as a placeholder with a status of Awaiting collection. The administrator can run the KPI Value utility when necessary, for example, when the automatically scheduled job fails to run. The utility creates the KPI Values with details, such as ID, Description, Expected Capture date, KPI Capturer, and KPI Owner. A notification that requests the KPI Capturer enters a KPI alue is presented in one of the following ways: Weekly notifications, which instruct the user to log in to IBM OpenPages. Based on the status of the KPI Value (Awaiting Collection) and the KPI Capturer (logged-in user), the KPI Value is shown on the user's home page. The notification that is sent to the KPI owner contains a list of KRIs that hae the following characteristics: An expected collection date that is less than (TODAY + 7) A KPI status that is set to Awaiting Collection. The KPI Breach notification sends an to the Risk Owner when a KPI breach status changes from Green to Red or from Amber to Red. The KPI Breach notification is started by the KPI Lifecycle trigger. The notification contains a link to the KPI that is in breach and adises the Risk Owner to reiew the breach and take appropriate actions. Chapter 5. Notifications 21

28 22 IBM OpenPages GRC Platform Version 7.0.0: Policy and Compliance Management Module Oeriew

29 Chapter 6. Reports PCM-specific Reports This section describes the reports that are aailable for the IBM OpenPages Policy and Compliance Management module. The IBM OpenPages Modules Report Details document proides additional information about the reports described here. There are seeral standard reports installed with the IBM OpenPages GRC Platform that are aailable to all modules. These additional reports are described in the IBM OpenPages GRC Platform Administrator's Guide. The IBM OpenPages Policy and Compliance Management module contains PCM-specific regulatory compliance reports. Table 6. Regulatory Compliance Reports Name Drill-Through Description Process Control Effectieness by Mandate Regulatory Applicability Matrix Process Control Effectieness by Sub-Mandate For a selected Business Entity, the report shows associated Mandates with the%ofeffectie Controls associated to Processes. The report can drill-through to a subreport for detail information Displays a Matrix View of the Mandates and the Business Entities for which they apply. Reports Shared with Other Modules The IBM OpenPages Policy and Compliance Management module contains a number of reports that are shared with other IBM OpenPages GRC Platform modules. Table 7. Risk Assessment Reports Name Drill-Through Description Risk Assessment List Shows Risk Assessment details for a specified Business Entity and all of its descendants. Risk Assessment Status Risk Assessment Status Detail Displays a stacked column chart showing the status of Risk Assessments for the specified Business Entity and its direct descendants. 23

30 Table 7. Risk Assessment Reports (continued) Name Drill-Through Description Risk Assessment Summary Risk Assessment Issues and Action Items Displays Risk Assessment details along with all associated Risks and Controls. A drill through report displays Issues and Action Items that are related to the Risk Assessments, Risks, orcontrols. Risk Assessment Issues and Action Items Shows all Issues and Action Items that are related to the selected Risk Assessment and its associated Risks and controls. Parent Object shows only the Risk Assessment, Risk, and Control parents. The report prompts for two alues: Business Entity and Risk Assessment. Data is filtered on the selected entity. Users can select from all Risk Assessments that are associated, whether directly or indirectly, to the selected business entity. Table 8. Risk Reports Name Drill-Through Description Risk Analysis Shows Risks grouped by Process for a specified Business Entity. Risk Heat Map Risk Detail Displays a table that aggregates Risks by Residual Impact and Likelihood for a specified Business Entity. Risk Rating by Entity Risk Rating by Entity Detail Displays Residual Risk Rating summary information for the selected Business Entity and its descendants, with the ability to drill-through to risk details. Risk Rating by Category Risk Rating by Category Detail Displays Risk Category and Residual Risk Rating summary information for the selected Business Entity, with the ability to drill-through to Risk details. 24 IBM OpenPages GRC Platform Version 7.0.0: Policy and Compliance Management Module Oeriew

31 Table 8. Risk Reports (continued) Name Drill-Through Description Top Risks Summary of the top Risks ranked by Residual Risk Exposure, and also shows the Inherent Risk Exposure. By default, Risk quantitatie assessment fields are not included in the IBM OpenPages Policy and Compliance Management module, so this report may not be appropriate for PCM users. Table 9. Control Reports Name Drill-Through Description Risk and Control Matrix Shows Risk and Control data for specified Business Entity and Process(es). Control Effectieness Map Control Effectieness Detail Control map shows counts of Controls grouped by Process or Processes and Operating Effectieness, with the ability to drill-through to a subreport for detail information. Table 10. Testing Reports Name Drill-Through Description Testing Dashboard Testing Details Displays summary Test Result information for the selected Business Entity, with the ability to drill-through to detail and trend information. Table 11. Indicator Reports Name Drill-Through Report Description KRI Dashboard KRI Dashboard Detail Summary KRI information is displayed for the selected Business Entity and its descendants. KPI Dashboard KPI Dashboard Detail Summary KPI information is displayed for the selected Business Entity and its descendants. Chapter 6. Reports 25

32 Table 12. Visualization reports Name Process Analysis Description Displays Risk and Controls in the context of a process diagram. Proides an aggregated iew of Risk and Controls with risk rating and control effectieness at the Process and Business Entity leel. 26 IBM OpenPages GRC Platform Version 7.0.0: Policy and Compliance Management Module Oeriew

33 Chapter 7. Triggers PCM-Specific Triggers The IBM OpenPages Policy and Compliance Management module contains seeral aailable triggers. The IBM OpenPages Modules Trigger Details document proides more information about the triggers described here. Before you use the ObjectManager tool to load XML instance data, you must disable triggers on any object types for which you will be loading data. Object types that are configured for the IBM OpenPages Policy and Compliance Management module to hae triggers by default include: Risk KRI Value KPI Value File (SOXDocument) Policy Action Item Issue Data Input Data Output Object types that are configured for other IBM OpenPages GRC Platform modules to hae triggers by default include: Audit Audit Section Workpaper Plan Timesheet Finding Audit Reiew Comment Loss Eent Loss Impact Loss Recoery This section describes triggers that are specific to the IBM OpenPages Policy and Compliance Management module. Policy Import Trigger The Policy Import Trigger imports Policy and Procedure content from a structured Microsoft Word document into OpenPages Policy and Procedure fields by parsing the different sections of the document. It is triggered by checking in an attachment to the Policy object. 27

34 The trigger is designed to support the Hybrid approach to Policy Management, but also supports updating ersion number in the Docucentric approach when a new policy document is checked in. As part of the import process, the trigger also performs extensie alidation to ensure that the structure of the Word document adheres to the defined Policy Template. IBM OpenPages or the customer can configure this component to behae as appropriate for the customers' methodology through registry and application text settings. The PCM Policy Import Trigger has the following known limitations: Bulleted lists only support the disc and circle bullet format. Numbered lists only support decimal, upper-alpha, lower-alpha, upper-roman, and lower-roman. Symbol fonts are not supported. Workaround is: Use Insert Symbol and select a symbol using normal font (for example, the copyright symbol). Wingding font is not supported. Cannot set Shading from Format Borders and Shading. Workaround: Use text highlighting to achiee similar affect. (.doc only) Will not display the alue of a FORMDROPDOWN. (.doc only) Ordered lists always use a period as the separator. For example, if a list item in the Word doc looks like 1) then it will be 1. after the import. For.doc, the style of the list item marker will be inferred from the text content of the list. The marker s font family and font size will match the first piece of text in the list item. The marker will be bold, italic, and/or colored if all the text in the list item has that same styling. Images, Word Art, and diagrams are not supported. Does not support importing a Table of Contents. All underline styles show as single solid line Superscript/subscripts defined by within a style are not supported (.doc only). Workaround is: Apply sub/superscript from the Font menu instead of using a style. Formatting oerrides that conflict with custom styles. For example, if custom style includes a Strong text format and the user manually un-bolds the text within the document, the text will show up bold per the Strong style. (.doc only) Tabs default to 4 spaces, which is not guaranteed to match the spacing in the document since tabs are based on positioning in the document. It is better to use indent when aligning content. Hanging indent (that is, First Line Indents) for lists is not guaranteed to line up perfectly due to the arying width of the list item markers. Within lists, mixing techniques for creating bullets, lists, and indentations will often result in items not being aligned correctly and incorrect numbering of items. Entering seeral carriage returns to create spacing will not render as extra spacing. Unsupported features: Changes in Text Direction Double Strike Through Emboss, Engrae, Shadow text 28 IBM OpenPages GRC Platform Version 7.0.0: Policy and Compliance Management Module Oeriew