Did you know?
Most organisations have the requirement to start afresh or at least monitor their risk registers from one year to the next. However, Risk Management does not work in the same way as a financial system, which is ‘closed off’ at year end. Whilst it may be necessary to add and/or delete risks that no longer exist, most risks carry on from one year to the next, albeit with risk and control rating re-assessment. By using BarnOwl’s Data Period functionality you can monitor the movement of all risks and controls from one period to the next whether monthly, quarterly or annually. We have noticed that some clients make the following common mistake (s):
- Copying their entire organsational structure from a 2018 node to a 2019 node. Whilst this is not such bad approach if your organsational structure and risk registers change drastically from one year to the next, it does mean that you lose the history (trends) of your existing risks.
- Creating new risks for each year and appending the year to the end of each risk title, for example, Risk AAAA 2016, Risk AAAA 2017, Risk AAAA 2018. This not a good approach as you will end up with very bloated risk registers and will not easily be able to pull reports for just your 2018 risks.
- At year end, overwriting your inherent risk ratings with your residual risk ratings. This is also not the correct approach as it means that your risks can never get worse from one year to the next even if your controls fail miserably. The only time your inherent risk ratings should change is when your business or market conditions change. Therefore, if ‘ shortage of coal’ was a key risk last year but this year you are moving to renewable energies then the inherent risk rating of ‘shortage of coal’ would come down.
Instead, you should be using BarnOwl data periods which store the risk and control ratings at the end of every period (monthly, quarterly, annually). In addition, data periods show you which risks have come and gone. I.e. which risks were created and/or deleted and in which period they were created or deleted.
Data Periods can be created manually in the Server Management Console, and enable you to create a “snapshot” of a specified period of time. It is also possible for BarnOwl to be configured to run data periods automatically. E.g. take a ‘snapshot’ of your risk and control registers on the 1st of every month.
Creating Data Periods Manually
You can create data periods manually in the Server Management Console General Setup tab.
As you can see above, this administrator has not created any data periods, so the only data period is labelled “Current”. When you create a data period by entering a data period name (e.g. 201801) and clicking on ‘Save’, all current data (risks and controls and their ratings at this point in time) will be saved to this data period. The ‘current’ data period then continues to track all changes from this point in time onwards until the next data period is saved.
Note: Ideally, you should run data periods monthly and should come up with ‘data period’ naming convention such as 201801, 201802,201803 (monthly) so that it is easy to sort and find your data periods when comparing previous periods to one another and to the ‘current’ period.
You can also specify which units in the Organisational Structure tree should be included in the Data Period.
Click Included Units in the General Setup tree, and select the units you wish to include in the Data Period by selecting the units.
The disadvantage of adding Data Periods manually is that you need to remember to create the new Data Periods when required. Therefore, if you wish to view your data in Quarters, you would need to create a new Data Period at the end of each quarter.
The alternative is to create Automatic Data Periods.
Creating Automatic Data Periods
BarnOwl makes provision for automatic Data Periods, which must be specified on your BarnOwl Application server directly. You will therefore require assistance from BarnOwl Support (support@barnowl.co.za) or your IT department. The advantage of automatic Data Periods is that you do not have to manually update your Data Periods.
Reporting on Data Periods
Data Periods enable you to report on the movement of your risks through a specified period of time. There are four reports you can run which use Data Periods to track movement:
- Reports>Trend>Control Trend report
- Reports>Trend>Residual Risk Trend report
- Reports>Trend>Risk Movement Trend report
- Reports>Trend>Risk Trend report
These reports provide you with an overall view of how your risk ratings have changed over a period of time, and you can identify risk trends quickly. In addition, these reports show you which risks have come and gone, forex example, those risks which were added or deleted, and in which period they were added/ deleted.
This image shows the Risk Trend report, with ratings per Data Period.
You can also view a residual risk trend heatmap as follows:
View>Risks>RR versus RR Risk Movement Heatmap
Enter the periods you wish to compare which in the example below is ‘Current’ to ‘2017 March’:
