Changes to risk data within Ruleguard

The next Ruleguard update contains a change to the way that risks are handled on the platform. It will have a small impact on the numbers of risks that you see in Ruleguard screens and MI reports in some situations.

No mappings of risk are affected in any way; this is purely a change that affects underlying data, so won’t affect coverage, completeness of matrix reports, documentation and so on, except for the risk naming/numbering point mentioned below.

What are we changing?

We are standardising the way that risks work in Ruleguard to be more like other pieces of information.

Instead of a risk having multiple versions for each topic that it belongs to, a risk will now work just like a process or control where it has one single version, mapped into multiple places. 

Why are we changing this? 

Currently, risks in Ruleguard have a different version for each topic that they are mapped into. We did this so that you could score a risk (Likelihood and Impact values) differently in each place that you mapped it. 

However, this approach has some limitations: 

  1. Risks cannot be mapped directly to rules but only topics.
  2. Changing the score of a risk in one topic does not change it in others, which is potentially confusing
  3. You cannot score a risk before mapping it somewhere
  4. Reporting shows an artificially high number of risks (one risk in ten topics is reported as ten risks) 

Results of the new approach 

After our new update, one risk will have one set of scores, and you will be able to map this to multiple places. It will be mappable directly to rules in the new mapping interface, if you wish.

If you do want to score a risk differently in different topic areas, you’ll need to create a second risk with the desired scores.

The upside is that a risk will now show a comprehensive view of each area where it’s relevant, and will display and be reported on in a way consistent with processes and controls in the system, making it easier to understand overall.

MI numbers may be affected; if a common risk had mappings in ten places before, it would have shown up as ten risks. Now, it will show up as one risk (with ten topic mappings). 

Any questions? 

We hope that this change will be a clear improvement in understanding and working with risks in Ruleguard, but if you do have any questions or problems arising from this, or would simply like to discuss it further, please let us know at hello@ruleguard.com.