Get help for ARIS Risk and Compliance

The organization has identified a weakness in the compliance of an organization, such as an internal policy that does not cover new regulatory requirements. This was uncovered by the corresponding compliance assessment workflow.

An incident happened in an organization related to an operational risk, such as fraud. This was only possible because no internal controls for such incidents existed in a new business process.

The regulation manager creates an issue describing the weakness of the policy in relation to the corresponding requirement and assigns the issue to the policy owner responsible (as the issue owner). The regulation manager assigns the new regulation, the corresponding regulatory requirement, and the policy that does not meet this new requirement to the issue. The regulation manager assigns the issue to oneself in the role of issue reviewer to be informed after the problem is solved and to check the solution.

The risk manager creates an issue describing the weakness of the process in relation to the corresponding risk. The risk manager understands exactly what the problem is and therefore assigns the issue to oneself in the role of issue owner. The issue relates to the incident, the corresponding risk, and the business process in which the incident occurred. The issue reviewer, who belongs to the quality management department, is specified by the risk manager and checks the solution after the problem is solved.

The policy owner (in the role of the issue owner) updates the relevant policy, initiates the policy approval and publishing process (policy roll-out). Then the issue owner documents the progress of the policy roll-out in the issue form to inform the regulation manager. The policy owner finally selects the Completed state for the issue.

The risk manager (in the role of the issue owner) describes a solution in the issue form and specifies a due date, then hands the issue over to the process owner (in the role of another issue owner), who is responsible to implement the remediation tasks. The process owner revises the business process and submits a change request in ARIS. Then the process owner documents the progress in the issue form, and when the revised process is designed and published, the process owner selects the completed state for the issue.

The regulation manager (in the role of the issue reviewer) reviews the solution of the issue and decides whether the solution is acceptable or not. In the latter case, the issue is returned to the issue owner.

The issue reviewer checks the original problem and the remediation tasks, then decides whether the solution is appropriate or not. In the latter case, the issue is returned to the issue owner.