Creating Risk Hierarchies

To add a parent risk

1. On the IT & Security Risk Management menu, select Risk Management > Risk Register. The Risk Register screen appears.

   
   
   

2. Open the risk in which you would like to add a related parent risk. The Risk Details screen appears.

3. Select the Related Risks tab.

4. Click the Identify Parent Risk button. The Identify Parent Risk modal appears.

   Note:

   You can select any risk from the Risk Register that has not already been related to this risk. The parent risks shown are filtered by the user organization level i.e. the user can see risks at their organization or below.

   Utilize the search bar, column selector, and filter as needed to locate risks. You can organize the risks that appear here and customize your own personalized saved view to manage your risks. See Configuring and Filtering List Screens for more information.

   
   
   

5. Select the parent risk from the list of existing risks in your Risk Register.

6. Click the Save button. The parent risk will be added to the Related Risks tab. You can only have one parent risk per record.

To remove a parent risk

You can unlink a parent risk to remove it from the risk record.

1. On the Risk Details screen, select the Related Risks tab.

2. Click the Context Menu icon for the parent risk you would like to remove.

3. On the Context menu, select Remove Parent Risk. The Remove Parent Risk modal appears.

   
   
   

4. Click the Continue button to remove the parent risk from the Related Risks tab of the Risk Details screen.

   Important:

   Removing the parent risk will also remove the related child risks from the risk hierarchy. The child risks will then become orphan risks. Orphan risks are risks without an identified parent or child risk.

   Click the Cancel button to discard the action of removing the parent risk. The existing parent risk will remain unchanged and you will be navigated back to the Risk Details screen.

To change a parent risk

Risks can dynamically change over time due to various factors such as business strategy acquisitions, resource shifts, and environmental factors. As a result, the nature of each risk and sub-risk being reported are likely to change.

To account for these changes, you can replace an existing parent risk that has been added to a risk record.

1. On the Risk Details screen, select the Related Risks tab.

2. Click the Change Parent Risk button. The Replace Parent Risk modal appears.

   Note:

   You can select any risk from the Risk Register to replace an existing parent risk with another risk. Risks that have already been related to this risk will not be shown.

   Utilize the search bar, column selector, and filter as needed to locate risks. You can organize the risks that appear here and customize your own personalized saved view to manage your risks. See Configuring and Filtering List Screens for more information.

   
   
   

3. Select the parent risk from the list of existing risks in your Risk Register.

4. Click the Save button to replace the parent risk.

   Click the Cancel button to discard replacing the parent risk. The parent existing parent risk will remain unchanged and you will be navigated back to the Risk Details screen.

To add a child risk

1. On the IT & Security Risk Management menu, select Risk Management > Risk Register. The Risk Register screen appears.

2. Open the risk in which you would like to add a related child risk. The Risk Details screen appears.

3. Select the Related Risks tab.

4. Click the Identify Child Risk button. The Identify Child Risk modal appears.

   Note:

   You can select any orphan risk(s) in your Risk Register as a child risk.

   Utilize the search bar, column selector, and filter as needed to locate risks. You can organize the risks that appear here by customizing your own personalized view to manage your risks. See Configuring and Filtering List Screens for more information. The parent risks shown are filtered by the user organization level i.e. the user can see risks at their organization or below.

   
   
   

5. Select the child risk(s) from the Risk Register that will be linked to this risk.

6. Click the Save button.

   Click the Cancel button to discard identifying a child risk. The child risk will not be linked to the record and you will be navigated back to the Risk Details screen.

To remove a child risk

You can remove a child risk from the parent risk to remove their relationship. By removing relationships between risks, the overall risk score will be recomputed.

1. On the Risk Details screen, select the Related Risks tab.

2. Click the Context Menu icon for the child risk you would like to remove.

3. On the Context menu, select Remove Child Risk. The Remove Child Risk modal appears.

   
   
   
4. Click the Continue button to remove the child risk from the Related Risks tab of the Risk Details screen.

   Important:

   Removing the child risk from the parent will remove the risk from the risk hierarchy and cause it to become an orphan risk. Orphan risks are risks without an identified parent or child risk.

   Click the Cancel button to keep the child risk linked to the parent risk. The child risk will remain on the Related Risks tab of the Risk Details screen and you will be navigated back to the Risk Details screen.

To display the risk hierarchy

You can access a hierarchy view of the parent and child risks related to a specific risk.

1. On the Risk Details screen, select the Related Risks tab.

2. Click the Display Related Risks button. The Display Related Risks modal appears.

   
   
   

3. Click the Open Risk Hierarchy Explorer button to navigate to the Risk Hierarchy Explorer screen to view all parent and child risk relationships within your organization.

   Click the Close button to close the modal and return to the Related Risks tab.

To open and complete a bulk import template

1. Click the Gear icon in the upper right-hand corner to access Global Settings.

2. On the Global Settings menu, select Data Import > Import Templates. The Import Templates screen appears.

3. Click the Download button for the Relate Risks tile to download the template.

4. Open the downloaded file in Microsoft Excel.

   Tip:

   The Relate Risks import template includes various tabs to help you complete the import successfully.

   Tab Name	Description
   Welcome	The Welcome tab is a cover page that explains the purpose of the import as well as key details that must be considered to align with OneTrust corporate branding guidelines.
   Instructions	The Instructions tab provides formatting guidelines and best practices that must be followed in order to import the template into OneTrust successfully. This tab also includes descriptions of the fields that appear on the Relate Risks tab.
   Relate Risks	The Relate Risks tab includes blank fields that must be completed by entering risk information. This information will be used to relate risks to other risks in bulk once the import is complete.
   List of Values	The List of Values tab includes a list of values that can be leveraged when completing fields on the Relate Risks tab.

5. Update the fields on the Relate Risks tab of the downloaded template in Excel.

   
   
   

   Field

   Description

   Risk ID (Source)

   Enter the unique identifier or system generated ID to establish a risk-to-risk relationship for the applicable risks identified within your organization. The relationship will be based on the relationship type.

   To locate the Risk ID, navigate to the IT & Security Risk Management module and select the Risk Register. The Risk ID will be located in the ID field on the Risk Register screen.

   Relationship Type

   Specify the type of relationship to establish the risk-to-risk relationship for the applicable risks identified within your organization.

   Note:

   Relationship Type options can be found on the List of Values tab.

   Currently, you can only create a Parent Of relationship type. This means that the source risk will become the parent of the target risk.

   Risk ID (Target)

   Enter the unique identifier or system generated ID to establish a risk-to-risk relationship for the applicable risks identified within your organization. The relationship will be based on the relationship type.

   To locate the Risk ID, navigate to the IT & Security Risk Management module and select the Risk Register. The Risk ID will be located in the ID field on the Risk Register screen.

   Note:

   Multiple children can be specified in one cell using the vertical bar symbol (|). See the image below for an example.
   
   

6. Save the downloaded Excel template filled with data offline to your computer.

To import a completed bulk import template into OneTrust

1. Click the New Import button on the upper right-hand corner of the Import Templates screen. The New Import modal appears.

2. Complete the fields.

   
   
   

   Field

   Description

   Import Name

   Enter a short name that identifies the purpose of the data import request.

   Import Description

   Enter a brief description of the import to state the purpose of the data import request for reporting purposes.

   Import Type

   Select Relate Risks.

   File

   Click the Select File button to select the file you want to import.

   Note:

   The supported file format is XLSX.

3. Click the Submit button to create the risk relationships outlined in the import template. Once the import is complete, the Bulk Import screen will appear with the status and result of the import.

   Note:

   The new relationships created will be displayed on the Related Risks tab of the Risk Details screen.

4. You can also view the status and result of your bulk import by selecting Data Import > Bulk Import on the Global Settings menu. For more information, see Viewing Notifications in the Application.

   Note:
   
   

   If there was an error with the upload, click the error link in the Result column to download the Bulk Import Error Export report indicating the errors. Common errors include:

   • The Risk ID (Source), Relationship Type, or Risk ID (Target) fields are empty or invalid.

   • You are trying to create a risk relationship that already exists.

To view parent-child relationships

The Risk Hierarchy Explorer screen displays the parent and child relationships within your organization. Parent and child risks relationships work together to form a hierarchy. The relationships appear as a tree hierarchy to show a complete contextual view of the risk universe. The tree view allows users to easily identify the aggregated risk scores and contributing risk factors rolling up to the enterprise level risk. You can expand the tree hierarchy to view the parent and child level risks.

Each relationship shown in the risk hierarchy tree view displays the risk name, the number of child risks associated with the record, risk scoring attributes, and rolled-up risk scores. The list of roll-up attributes and applicable aggregator function can be configured as per enterprise needs, this activity is tracked in the Attribute Manager which will be managed by the application administrator.

1. On the IT & Security Risk Management menu, select Risk Management > Risk Hierarchy Explorer. The Risk Hierarchy Explorer screen appears with information related to the parent and child risks relationships.

2. Expand or collapse the parent and child risks as needed using the icon. You can use the zoom in / zoom out feature to view more or less of the tree.

   
   
   
   Important:

   • The current risk hierarchy supports 0-5 levels. You can have risks without hierarchy or a max of 5 levels.

   • Replacing the parent risk will remap all its children and grandchildren risks to the new parent. This will place the new parent as level 1, with children and grandchildren assuming level 2 and beyond.

   • You can only add a new child risk. The only way to remove a child risk is to replace its parent.

3. Click the Reset Tree View button to reset the screen view to the original configuration.

   
   
   

To view risk scores and details

You can easily view relevant parent and child risk metadata including the risk name and scoring insights directly from the Risk Details Pane on the Risk Hierarchy Explorer screen.

1. On the IT & Security Risk Management menu, select Risk Management > Risk Hierarchy Explorer. The Risk Hierarchy Explorer screen appears.

2. Click the View All Scores button on the parent or child risk. The Risk Details Pane will appear on the right-hand side, displaying relevant risk scoring insights and the risk name.

   
   
   

3. Option 1: Click the Close icon to close the Risk Details Pane and return to the full view of the Risk Hierarchy Explorer screen.

   Option 2: Click the View Full Record link on the Risk Details Pane to open the Risk Details screen in a new window to view the full risk record.

To search risks within the hierarchy

You can use the Search field on the Risk Hierarchy Explorer screen to search for specific risks across your organization. The Search field allows you to search for all parent and child risks in your risk hierarchy.

1. On the IT & Security Risk Management menu, select Risk Management > Risk Hierarchy Explorer. The Risk Hierarchy Explorer screen appears.

2. In the Search field, enter the name of the risk you want to search and press the Enter key. The Search popover will populate with risks that contain the words you entered.

   Note:

   You can also click inside the Search field to scroll through the list of available risks.

3. Click the name of the risk to display the parent risk and all related child risks.

   
   
   

4. Click the X icon in the Search field to reset the screen view to the original configuration.

To add an aggregated attribute

1. On the IT & Security Risk Management menu, select Setup > Attribute Manager. The Attribute Manager screen appears.

2. Click the View button on the Risk Attributes tile.

3. Click the Add Attribute button. The Add Attribute modal appears.
   
   

   Field

   Description

   Name

   Enter the name of the attribute to help identify the aggregated attribute. This attribute will calculate the aggregated risk scores shown on the Risk Hierarchy Explorer screen.

   Level Name (Reporting Only)

   Enter a name for the label used in reports. The Level Name appears for all score type attributes.

   Description

   Enter a brief description of the attribute.

   Response Type

   Select Score.

   Score Type

   Select Rollup.

   Required Checkbox

   Check this box if you would like this to be a required attribute when creating a new risk.

   Link Category

   If enabled, this allows you to select risk categories related to the attribute.

   If disabled, you will not be able to relate a risk category to the attribute.

   Rollup Attribute

   Select the active system or custom risk attribute that will follow the selected aggregation method.

   Note:

   The attribute response types available are numerical single select, formula, and score.

   Aggregation Method

   Select the aggregation method used against the risk attribute selected for roll-up computation. The roll-ups can be completed using the following aggregation:

   Average

   This function returns the average value of the risk scoring based attributes that is supplied as a parameter for aggregation.

   Note:

   The Average aggregation method is the default function due to the nature of the ITRM Framework readiness and customer preference.

   Count

   This function returns the number of rows in the result. It does not count the null values.

   Sum

   This function sums up the risk scores in the specified risk attribute supplied as a parameter for aggregation.

   Maximum

   This function is used to find maximum risk score in the specified risk attribute that is supplied as a parameter for aggregation. It can be used on any type of data.

   Minimum

   This function is used to find minimum risk score in the specified risk attribute that is supplied as a parameter for aggregation. It can be used on any type of data.

   Edit Formula

   Click the Edit button to edit the score levels. For more information, see the Configuring Standard and Formula Score Attributes article.

4. Configure the fields as needed. You must select Score and Rollup for the response and score type.

5. Click the Save button. The aggregated attribute will be added to the Risk Hierarchy tab.