How does the risk module work?

Risk identification helps us to be alert about events that could occur in the company and their repercussions.

With our risk module you can register all the potential threats to which your company is exposed, classifying their impact and frequency, associating processes and controls and designating those responsible for the risk.

We explain how to register your risks 🤓

How to create a risk?

In the Pirani sidebar you will find the "Risks" section, when you click on it you will see the "Create risk" button where you will see a board to create the risk.

How to register general information?

As part of the creation process there are 3 mandatory fields that you must fill in this dashboard and other optional ones that will help you to complement the risk information:
Name: this will allow you to easily identify it in the future.
Impact: you must give a rating to each of the variables between 20% (low) to 100% (high). Remember that this indicates the level of damage that this risk may cause when it materializes.

Frequency: you can qualify it as improbable, probable, occasional, likely or very likely. Remember that it is the probability of this risk occurring.
In addition to these fields, you can add a description to better understand the risk being created, assign evidence, indicate the factor and treatment of the risk.

How to associate risks?

You will be able to associate your risks with processes, controls, causes and consequences, events, action plans and responsible parties. Below I will show you some of these associations. 

⚡ In addition, I leave you a step-by-step tutorial on how to associate your risks How to make associations in ORM ?

How to associate a risk to a process?

A risk can be associated with one or several processes, that is why when creating or editing a risk you will be able to indicate in which of the processes you registered it could materialize. Making this association will allow you to later filter your risk matrix by each process.

To associate a risk with a process, click on the "Add" button located in the "Processes" section of the dashboard. Note that each time you associate a sub-process or process, it will automatically associate its "parent" macro-processes and processes.

How to associate a cause or consequence?

Click on the risk to which you want to associate it, go to the "Causes and consequences" section and click on the "associate" button, there you will see the list of records in the module you are in. In this section you can search for the records with the search engine or choose from the options available in the module.
Finally, click on the "Save changes" button to associate them.

⚡ To make the association you must click on the "+" icon on the right side of the record to be selected.
Learn more details of causes and consequences here.

How to associate a control to your risk?

To associate a risk with a control, inside the create risk box go to the left side to the controls section and click on the "associate" button, there you will see the list of records in the module you are in. In this section you will be able to search for the records with the search engine or choose from the options that the module has.

⚡ To make the association you must click on the "+" icon on the right side of the record to be selected.

After clicking on the "+" icon you must indicate what percentage of mitigation will have control over the frequency and impact. This will directly affect the quadrant of the matrix where the residual risk will be.
There are controls that only mitigate the frequency or controls that only mitigate the impact, while others help to mitigate both elements. The important thing is that when you associate a control to a risk, always choose at least the mitigation percentage of at least one of the two.

How to associate a responsible person?

To associate a manager to the risk, in the create risk box go to the left side to the managers section and click on the "associate" button, there you will see the list of created manager groups or create a new group. In this section you can search for records with the search engine or choose from the options available in the module.

⚡To make the association you must click on the "+" icon on the right side of the record to be selected.

How to edit a risk?

You can edit the risk fields at any time. Enter the Risk Panel and click on the name of the risk you wish to modify, the "See more" button will appear on the right side, when you click on it you will be taken to the risk dashboard where you will be able to:

- Change your risk name, impact rating and frequency.
- Associate or eliminate processes, controls, causes and consequences, events, action plans and responsible parties.
- Modify the description.
⚡ Remember to click on "save changes".

How to create a risk assessment?
With assessments you will be able to monitor, follow up and give continuity to the risk management, to create them you must go to the main panel on the left side and click on the "assessments" section. Here I leave you a detailed tutorial to create assessments.

⚡ Remember that this functionality will be available in the Pro plan.

How to delete a risk?

You can delete it by clicking on the name of the risk that you no longer wish to have, on the right side you will find a trash can icon, when you click on it you will see a warning that will remove all the information that contains that risk, as well as its associations with processes or controls.

How to bulk import risks?

With the bulk import function you can easily import hundreds of records from your organization to the risk module using an xlsx file format.
To import the events you must go to the top bar of Pirani and click on the "Parameterize" gear icon, when you click on it you will get two sections on the left side: Transversal and ORM, click on ORM and finally choose the "Bulk Import" option.

⚡Here is a detailed tutorial on how the bulk import works. 

Then go to the "risks" section and there you will find a box with the option to import the risks and the key elements that the file to be uploaded must have.