topic Re: Risk Assessment workflow in Governance and Compliance Manager in SAS Risk Management

Risk Assessment workflow in Governance and Compliance Manager

MohsinRaza — Thu, 24 Jul 2025 08:15:24 GMT

Hi,

I am a new user on Governacne & Compliance Manager. We are considering following two approaches to standardize our regular risk assessments.

1. Collect asset information against each risk assessment activity and add risks, threats and vulnerabilities against each risk assessment every time and evaluate control effectiveness. In this approach risks, assets, and vulnerabilities might have duplications, but we can start with tiny steps.

2. Collect complete asset inventory, potential risks, threats and vulnerabilities and upload into the system. For each risk assessment we can select associated assets, risks, threats and vulnerabilities from already uploaded data and evaluate control effectiveness against each risk assessment exercise.

Can someone please guide what is the right approach to move forward with a consistent and sustainable approach.

Thanks,

Re: Risk Assessment workflow in Governance and Compliance Manager

KPotter — Tue, 29 Jul 2025 12:00:53 GMT

the second approach is the likely more effective approach. Building your inventory of assets, risks, controls, threats etc, allows you to reuse those for assessments and builds up a history of where those are used for further analysis later on.

Hope that helps!

Re: Risk Assessment workflow in Governance and Compliance Manager

MohsinRaza — Wed, 30 Jul 2025 06:32:50 GMT

Thanks KPotter