Skip to main content

Get help for ARIS Risk and Compliance

Create deficiencies manually

As an alternative to the deficiencies that are generated automatically from the testing process, the Deficiency manager (L1) can also create a deficiency manually.

Prerequisite

You have the Deficiency manager (L1) role.

Procedure. Procedure

  1. Open a new Deficiency form.

    1. Click Explorer Explorer.

    2. Click Deficiency Management > Deficiencies.

    3. Click New Create.

    4. If you are logged in as a user with cross-environment authorization, a dialog is displayed with the available environments. Select the environment and click OK. The Classification for the deficiency is displayed.

  2. Edit the classification.

    1. In the Affected organizational units row, click Create assignment/Assign Assign to assign the organizational units of the company that are affected by the deficiency. These must be modeled in the company organizational chart and be available as hierarchy elements in ARIS Risk and Compliance.

    2. Edit the optional fields, for example, company code, location, and country of the subsidiary.

  3. Edit the description.

    1. Describe the deficiency in detail by editing the mandatory fields (Mandatory field, Recommended field): Control level, Function (where the deficiency occurred in the process), Start of control period, End of control period, Deficiency description level 1, Related assertions, COSO components, Deficiency identified by, Probability before compensation control, Magnitude before compensation control and Comment on magnitude before compensation control.

    2. Edit the optional fields. For example, describe the deficiency or the related IT applications, in order to describe the deficiency in more detail.

  4. Edit the valuation.

    1. Edit the mandatory fields (Mandatory field, Recommended field) and the optional fields.

    2. If required, enter the link to compensation control level 1, as well as a note on compensation control level 1 and whether the compensation control on level 1 was tested effectively.

    3. By documenting the compensation controls, you provide a detailed evaluation of the deficiency. To do this, you must check whether controls are already implemented, for example, in a downstream step in the process that could identify the deficiency. This does not change the frequency of occurrence of the deficiency, but the magnitude can be reduced. If the evidence for a compensation control is already available in ARIS Risk and Compliance as an effective test, you can assign it directly in the system (Link to compensation control level 1).

  5. Edit the status and save your entries.

    1. Edit the mandatory fields (Mandatory field, Recommended field).

    2. Once you have specified all required entries, select the status Approved.

    3. Click Save Save. Deficiency editing is completed for this level.

Your entries are saved. This releases the deficiency for the next editing level. The deficiency now has the status Released in your list of deficiencies. You can still view your entries and those from any subordinate level (if available), but you can no longer change them. If you selected the status In progress, your entries are saved and you can continue editing the deficiency at a later time.