P-CO-R Assignment 

Use

In the central process catalog, you assign one or more control objectives (CO) to a process (P). By doing so, you define the objectives of the process steps defined as controls in that process. You then assign one or more risks (R) to the combination of process and control objective. A risk is a potential event that adversely impacts the desired outcome of a control objective.

Prerequisites

In Customizing for MIC under Edit Attributes ® Attributes with Dependent Attributes, the power user has created control objective categories and one or more control types for each control object category.

Features

For each control objective, you select a control objective category that has been created in Customizing for MIC. The control objective category determines which control types can later be used as an attribute for a control during the documentation of controls .

For each risk, you specify which condition could cause the risk to come into play and which consequencethis could have. Furthermore, you can specify what would be the qualitative impact of the risk (such as negligible, minimal, immense). You can define the possible values in Customizing under Edit Attribute Values.

The validity periods of the process, control objective, and risk must be compatible. This means that the validity period of a control objective must fall within that of the process, and the validity period of the risk must fall within that of the control objective.

Example

Process: Order Processing

Control Objective: Only authorized transactions are posted

Risk: The transaction is not reviewed conscientiously