Who is this article for?

Users who want to know more about the 12.0 Key Risks enhancements.

No elevated permissions are required.

Introducing Key Risks within Annual Planning enhances risk coverage and integration throughout the product. Seamlessly integrated into the audit workflow, Key Risks can be mapped into the Entity Universe structure for comprehensive coverage and analysis.

1. Overview
2. User guide
   1. Creating and managing Key Risks
   2. Mapping Key Risks to entities
   3. Linking Key Risks to audits
   4. Using Key Risks in work programmes
3. Further reading

1. Overview

Advancing the coverage and integration of Risk throughout the product, the introduction of Key Risks within Annual Planning provides an enterprise level risk library within the client-based audit application.
Key Risks integrate seamlessly throughout the audit workflow and can be mapped via matrices into the Entity Universe structure, to ultimately provide the opportunity for coverage outputs and testing gap analysis.
While inheriting useful sub-components such as metadata, attachments and review comments, Key Risks are fully reportable within the programmatic API as part of a bespoke report or Data Visualisation table.

2. User guide

The properties of Key Risks are managed centrally in the Annual Planning module, alongside other core activities that take place prior to engaging in audit activity.
With advanced Risk Assessment methodology applied (subject to additional configuration) the applicable Key Risks can also be incorporated into the risk assessments performed against audit entities and/or potential planned audits for the purpose of establishing and prioritising audits within the annual audit plan.

2.1 Creating and managing Key Risks

1. To introduce new Key Risks, select Create key risk and enter the relevant information, including what areas of the entity universe it should be used for:

2. More advanced properties can be customised though Metadata, created in the Template Designer module.
3. All new key risks will appear in Draft status and cannot be used as part of auditable activity until reaching a status of Active.
4. Select Change state from the key risk Details pane and update the status accordingly.
5. Retired key risks will not appear available to use for new audits but may already be in use for current and prior audits.
6. The option to Deactivate allows a currently Active risk to revert back to Draft status.

7. Icons to the left of the Key Risk library denote the status of each item at a glance.
8. To edit an existing Key Risk that has already been saved to the server, locate Lock selected risk for editing:

9. All updates to the Key Risks must be saved to the server by clicking Synchronise button which flashes to indicate that changes have been detected.
10. If changes have been made in error, Discard changes may be used instead.

2.2 Mapping Key Risks to entities

1. Mapping key risks to the relevant entities of the entity universe structure can be performed within the key risk itself or as a separate task, with visibility of all other key risks in one place.
2. Select Key risk mapping to open a matrix of the relationships between key risks and the entity universe:

3. Different display methods can be applied to show mapping based on entity universe Types rather than levels:

4. The mapping applied determines which key risks are available to be linked to audits, via Annual Planning and/or Audit Management.
5. When using planned audits in Annual Planning (i.e. created via Manage planned audits), the key risks available to link are displayed in the bottom right-hand corner of the screen.
6. It is possible to link one or many Active key risks in this way.

2.3 Linking Key Risks to audits

1. In Audit Management, whether importing audits from the default plan, from the Schedule, or creating ad hoc unplanned audits, the audit file contains a new section dedicated to Key risk mapping.

2. While this section is read-only, and available to hide if necessary by creating an Audit File Template, the user can provide assurance against the key risks by connecting elements of the fieldwork to one or many key risks.

2.4 Using Key Risks in work programmes

1. One of the ways this can be accomplished is through the Customise Template option within Work Programmes (additional System Configuration setting may be required if this is not currently available):

2. In the template editor that opens, each Risk, Control or Test can be connected back to the key risk through Informed items:

3. Save the customised Work Programme and save the audit file to the shared server. Once done, navigate back to the Key risk mapping section of the audit file to confirm that the changes have been applied.

4. If the Customise Template option is unavailable, but users have the ability to edit template items during live fieldwork (i.e. using the setting below for example) it is possible to adjust the Informed Items during that stage of the audit rather than during the preparatory stage.

5. Instead of using Informed Items, which separates key risks from specific Work Programme risks, users have the option to directly add mapped key risks into the Work Programmes.
6. To do this, users can either customise the template or, if the Add Risk feature is enabled, select Import Risk and search for the relevant item.

Note: There are now additional controls to determine if the Import Risk option is available globally. Upgrading customers will see this setting automatically enabled.

7. The example below illustrates the import procedure as part of Audit Work:

Note: Unmapped key risks cannot be imported, or linked via informed items, unless previously mapped to the relevant entity in the main Key Risks module of the system. 

3. Further reading

• 12.0 Entity Universe structural management release notes
• 12.0 Key Dates methodology release notes
• 12.0 Recommendation methodology release notes