77 lines
4.1 KiB
Text
77 lines
4.1 KiB
Text
Business Process: Risk Management Cycle (IDW PS 340)
|
|
|
|
START
|
|
|
|
|
|- [Task: 1000] Risk Identification
|
|
| Team: Risk Owner (Operational Unit)
|
|
| Description:
|
|
| A potential risk has been identified within an operational unit. The Risk Owner captures basic data (Category, Description, Early Warning Indicators) to initiate the process in accordance with KonTraG.
|
|
| |-- [Event: 10] Submit Proposal (Forward to Central Risk Management) --> [Task: 1100] Validation
|
|
| |-- [Event: 20] Discard (Draft deleted) --> [Task: 1990] Deleted
|
|
|
|
|
|- [Task: 1100] Validation
|
|
| Team: Central Risk Management
|
|
| Description:
|
|
| Central function checks if the identified issue qualifies as a relevant risk or if it is a duplicate.
|
|
| |-- [Event: 10] Confirm Risk (Risk is valid, proceed to assessment) --> [Task: 1200] Gross Assessment
|
|
| |-- [Event: 20] Reject (Not a risk or duplicate) --> [Task: 1900] Archived
|
|
| |-- [Event: 30] Request Info (Send back to Owner for details) --> [Task: 1000] Risk Identification
|
|
|
|
|
|- [Task: 1200] Gross Assessment
|
|
| Team: Risk Owner (Operational Unit)
|
|
| Description:
|
|
| Quantitative assessment of the risk WITHOUT considering planned or existing measures. Impact and Probability are estimated to determine the Gross Risk Score.
|
|
| |-- [Event: 10] Save Gross Data (Proceed to Measure Definition) --> [Task: 1300] Measure Definition
|
|
|
|
|
|- [Task: 1300] Measure Definition
|
|
| Team: Risk Owner (Operational Unit)
|
|
| Description:
|
|
| Definition of risk mitigating measures (Avoid, Reduce, Transfer, Accept). Documentation of costs and responsibilities for these measures.
|
|
| |-- [Event: 10] Measures Defined (Proceed to Net Assessment) --> [Task: 1400] Net Assessment
|
|
| |-- [Event: 20] Update Assessment (Go back to Gross Assessment) --> [Task: 1200] Gross Assessment
|
|
|
|
|
|- [Task: 1400] Net Assessment
|
|
| Team: Risk Owner (Operational Unit)
|
|
| Description:
|
|
| Re-evaluation of Impact and Probability taking the defined measures into account (Residual Risk). Crucial for IDW PS 340 compliance.
|
|
| |-- [Event: 10] Submit for Aggregation (Forward to Central RM) --> [Task: 1500] Aggregation & Analysis
|
|
|
|
|
|- [Task: 1500] Aggregation & Analysis
|
|
| Team: Central Risk Management
|
|
| Description:
|
|
| The risk is analyzed in the context of the total risk portfolio (Risk Aggregation/Monte Carlo Simulation) to check against the company's Risk Bearing Capacity.
|
|
| |-- [Event: 10] Approve (Risk within appetite, standard monitoring) --> [Task: 1600] Monitoring
|
|
| |-- [Event: 20] Insufficient Mitigation (Measures not enough, send back) --> [Task: 1300] Measure Definition
|
|
| |-- [Event: 30] Critical Escalation (Threat to existence, forward to Board) --> [Task: 1550] Board Review
|
|
|
|
|
|- [Task: 1550] Board Review
|
|
| Team: Management Board / Risk Committee
|
|
| Description:
|
|
| High-level decision required. Risk exceeds risk bearing capacity or is a "bestandsgefährdendes Risiko" (§91 Abs. 2 AktG).
|
|
| |-- [Event: 10] Accept Risk (Special approval granted) --> [Task: 1600] Monitoring
|
|
| |-- [Event: 20] Demand Action (Force new measures) --> [Task: 1300] Measure Definition
|
|
|
|
|
|- [Task: 1600] Monitoring
|
|
| Team: Risk Owner (Operational Unit)
|
|
| Description:
|
|
| Continuous surveillance of the risk and the effectiveness of measures. Periodic review (e.g., quarterly).
|
|
| |-- [Event: 10] Report: No Change (Keep monitoring) --> [Task: 1600] Monitoring
|
|
| |-- [Event: 20] Risk Changed (Values or measures changed) --> [Task: 1200] Gross Assessment
|
|
| |-- [Event: 30] Risk Obsolete (Risk no longer exists) --> [Task: 1800] Closure Review
|
|
|
|
|
|- [Task: 1800] Closure Review
|
|
| Team: Central Risk Management
|
|
| Description:
|
|
| Final check if the risk can really be closed.
|
|
| |-- [Event: 10] Close Risk (Archive) --> [Task: 1900] Archived
|
|
| |-- [Event: 20] Deny Closure (Keep active) --> [Task: 1600] Monitoring
|
|
|
|
|
|- [Task: 1900] Archived
|
|
| Team: System
|
|
| Description:
|
|
| Risk is closed but kept for audit trails and historical data analysis.
|
|
| |-- [Event: 10] Reactivate --> [Task: 1100] Validation
|
|
|
|
|
END
|
|
|
|
|
|- [Task: 1990] Deleted
|