برنامج إدارة بيانات المخاطر ويب

Risk Data Management Software (RDMS) (Lightweight)

1. Objective

Design and deliver a lightweight risk data management software (RDMS) that enforces:

• structured, high-quality risk data

• clear ownership and accountability

• objective prioritization using likelihood, impact, and urgency

• transparent executive reporting

The system is not intended to be a full ERM platform.

2. In-Scope Functional Deliverables

2.1 Risk Register Module

Deliverables

• Create / edit / archive risks

• Mandatory structured fields:

o Risk ID (system-generated)

o Risk Code

o Entity

o Department

o Risk Statement

o Risk Type (Threat / Opportunity / Issue)

o Cause

o Effect (business wording)

o Trigger

o Risk Source

o Likelihood (1–5)

o Impact (1–5)

o Urgency (1–5)

o Impact Value ($)

o Treatment Strategy

o Treatment Actions

o Risk Owner

o Risk Action Owner

o Fallback Plan

o Identify Date

o Due Date

o Revised Impact Value

o Revised Probability

o Contingency Reserve

o Action Cost Value

o Saving

o Comments

o Status (Open / Mitigating / Closed)

o Closing Date

• Read-only calculated fields:

o Risk Score = Likelihood × Impact

o Risk Priority = Impact × Urgency

o Risk Rank

o Priority Rank

o Contingency Reserve

o Saving

Enforcement rules

• Risk cannot be saved without owner, statement, cause, impact, and scores

• Risk cannot be closed with open actions

• Scores and rankings are system-controlled

2.2 Ranking & Prioritization Engine

Deliverables

• Automatic calculation of:

o Risk Rank (based on Risk Score, descending)

o Priority Rank (based on Risk Priority, descending)

• Real-time rank recalculation when risks are added or updated

• Tie handling without forced differentiation

• Visual indicators for:

o Top 10 risks by severity

o Top 10 risks by priority

2.3 Accountability & Audit Trail

Deliverables

• Immutable audit log capturing:

o field changed

o old vs new value

o user

o timestamp

• Owner-based responsibility model

• Visibility of overdue risks and actions

2.4 System & Reporting Deliverables

1. Risk Management System:

• Import Risk Data from Excel

• Design

• Tables

• Queries

• Forms

• Reports

• Coding

• User Manual

2. Risk Reporting Deliverables:

• Executive Risk Summary Dashboard

o Audience: CEO, Executive Management

• Top Risks by Priority Rank

o Audience: CEO, Executive Management, Risk Committee

• High Severity Risk Register

o Audience: Risk Committee, Internal Audit

• Overdue Risks and Actions Report

o Audience: Executive Management, Department Heads, Risk Owners

• Risks by Owner Report

o Audience: Executive Management, HR, Risk Function

• Risk Distribution by Type (Threat / Opportunity / Issue)

o Audience: Executive Management, Strategy

• Risk vs Priority Scatter Analysis

o Audience: CEO, Executive Management, Risk Committee

• Risk Checklist

o Department Heads, Risk Owners, Risk Officers, Risk Champions

• Risk Register

o Audience: Department Heads, Risk Owners, Risk Officers, Risk Champions

• Risk Status Trend Report

o Audience: Department Heads, Risk Owners, Risk Officers, Risk Champions

1. KPI Summary

o Total active risks

o High severity risks

o High priority risks

o Overdue actions

2. Risk vs Priority Scatter Chart

o X-axis: Risk Score

o Y-axis: Risk Priority

o Size: Urgency

o Color: Status

3. Top 10 Risks by Priority Rank

o Rank

o Risk Statement

o Owner

o Due date

o Days overdue

4. Risks by Owner

o Bar chart highlighting ownership concentration

5. Status Trend

o Open vs Closed over time

2.5 Access Control

Deliverables

• Role-based access:

o Viewer

o Editor

o Risk Owner

o Administrator

• Read-only access for executives

• Controlled edit permissions for scoring fields

3. Non-Functional Deliverables

• Clean, simple user interface

• Responsive web access (desktop-first)

• Export to Excel (risk register & reports)

• Configuration documentation (fields, scoring logic, rules)

• Basic user guide (admin + end user)

4. Explicit Exclusions

The following are out of scope for this phase:

4.1 Functional Exclusions

• Risk appetite modeling or tolerance engines

• Key Risk Indicators (KRIs)

• Control effectiveness testing

• Automated escalation workflows

• Email or system notifications

• Approval chains beyond basic ownership

• Integration with ERP, HR, SharePoint, Power BI, or SSO

• Multi-language support

• Mobile application

4.2 Governance & Compliance Exclusions

• Regulatory compliance mapping

• External audit reporting

• Legal or regulatory risk libraries

• Enterprise-wide ERM consolidation

4.3 Technical Exclusions

• Advanced analytics or AI

• Custom visualization engines

• Historical data migration (unless separately agreed)

• High-availability or disaster recovery beyond standard hosting

5. What This Scope Deliberately Optimizes For

✔ Data discipline

✔ Accountability visibility

✔ Decision-oriented reporting

✔ Fast delivery

✔ Low maintenance