SOLUTION BRIEF
Archer Operational
Risk Management
With the increasing number, complexity and velocity of risks, ad hoc approaches
to risk management create inefficiencies that leave risk management teams
overwhelmed with their workload and the business scrambling to make informed
business decisions. Risks can get lost “in the cracks” between risk functions, leaving
the business to struggle to identify business priorities and assign accountability
to known risks and controls. The result is reactive rather than proactive risk
management, leaving the business to scramble to react when incidents occur.
Unfortunately, many organizations have not taken a proactive, comprehensive
approach to managing risk. By managing many different types of risks in different
business silos and assessing risks using separate methodologies and measurements,
there is no way to provide management with an accurate and aggregated view of
risk across the business. Without this aggregate view, risk cannot be consistently
managed within the organization’s risk appetite.
Your executive team and board of directors need assurance that your organization’s
internal control framework is adequately designed and operating to ensure that
risk is being effectively managed. Without this visibility, risk cannot be consistently
prioritized and managed within the organization’s limits and there is no way to
provide your executive team and board with an accurate, aggregated and timely
view of risk across the business.
Take charge of Risk Management
Establishing a central repository for risk- and control-related data is the first step
in ensuring you have an accurate and comprehensive view of risk that can be readily
conveyed to your executive team and board. Engaging your business units (the first
line of defense) in risk management practices extends your ability to gain greater
insight into known and emerging risks. The engagement across your lines of defense
strengthens the effectiveness of your risk management program by assuring your
risk data is accurate and complete and your business unit managers are taking
appropriate responsibility for their risks and internal controls.
Efficiencies gained by streamlined processes free up your risk management team
to focus on more important issues than program administration. The ultimate goal
is to reduce the likelihood and impact of negative events, lost opportunities, and
surprises and increase the probability that your objectives will be met, in order
to maximize the performance of your business.
The Archer Operational Risk advantage
Archer Operational Risk Management provides a clear and consolidated view of risk that allows you to prioritize risks,
efficiently deploy resources to address the most critical problems and elevate risk management as a new source of
competitive advantage.
Engage business units as the first line of defense
Operational risk management is not solely the responsibility of the risk specialist team. Your business units must be more
directly involved with day-to-day risk management. Business unit managers know which risks are changing, which risks are
emerging, which risk treatments are being implemented and which ones are operating.
Archer Operational Risk Management helps enforce accountability for risk and internal controls. You can partner with the
first line of defense to engage business teams to be actively involved in understanding and assessing risks within their
complex operations. This allows risk managers to more easily consume new risk information into existing risk management
processes and expand their risk programs to uncover emerging risks, including those emerging from business changes.
Address risk consistently across the business
Many businesses experience loss events and incidents that are not identified, assessed, treated and monitored consistently
across all business units. When business units talk about risk in a different “language” with different measurements,
controls and reporting, everyone has a different view and evaluation of the risks to the business.
Archer Operational Risk Management enables you to standardize the risk management process across your enterprise.
You can establish a common risk language, measurement approach, and rating scales and explicitly articulate individual
responsibility for business activities, risks, controls, policies and procedures. This enables you to quickly prioritize risk,
clearly inform all stakeholders, and evaluate and manage risk consistently. When incidents or gaps do occur, you can
then escalate risk decisions in accordance with the significance of each risk and the authority to accept risk that has
been delegated to managers.
Improve risk visibility
For effective operational risk management, you need to be able to understand the complex relationship between business
processes and risks and controls, and quickly report and respond to risks that impede your organizational objectives as
they emerge. Without a centralized approach that provides critical business context, it is difficult to get a complete view
of the state of your organization’s risk without spending weeks sifting through data. Your executive team and board
require an accurate, real-time picture of risk in order to properly allocate resources and make better business decisions.
The robust reporting and risk management architecture available in Archer Operational Risk Management allows you
to report and respond to risks that challenge your organizational objectives as they emerge. Loss events and key risk
indicators provide insight into current risks and allow you to keep track as warnings emerge, perform risk analyses and
quickly explore the entire risk management framework deeply in real time to understand risk drivers.
Archer Operational Risk Management
Archer Operational Risk Management makes it easy to engage your first line of defense to identify and assess risk;
evaluate, approve and respond to loss events; oversee key risk indicators; and manage day-to-day tasks, issues, and
remediation plans. Serving as an aggregation point for your organization’s operational risk management program, Archer
brings together data often found in siloed risk repositories to identify, assess, evaluate, treat and monitor risks consistently
across your organization. With the ability to better understand, prioritize and manage known risks, you can expand your
Archer Operational Risk Management | 2
program to include additional business units and risks, or redeploy risk management resources freed up as a result of more
efficient program management.
Archer Operational Risk Management provides several use cases to meet your specific business needs and risk
management program maturity journey, including:
▪ Archer Issues Management allows you to capture and consolidate risks that exceed acceptable levels and need
to be addressed; failed or deficient internal controls; key indicators outside boundaries; and loss events requiring
remedial actions.
▪ Archer Risk Catalog provides the foundation to record and track risks across your enterprise and establish
accountability by business unit and named first line of defense manager. Inherent and residual risk can be assessed
utilizing a top-down, qualitative approach, with assessed values rolling up to the associated business unit and
enterprise risks.
▪ Archer Top-Down Risk Assessment builds upon the Risk Catalog and enables practitioners to document risk and
control procedures. Risks can be associated with business processes and assessed on an inherent and residual basis,
both qualitatively and across multiple risk categories using monetary values.
▪ Archer Loss Event Management allows you to capture and inventory actual loss events, near misses and external loss
events that may be relevant to your business and industry. Loss event root cause analysis can be performed for the
purpose of taking appropriate actions to reduce the likelihood and impact of similar losses occurring in the future.
▪ Archer Key Indicator Management provides a means to establish and monitor metrics related to risks, controls,
strategies and objectives. With configuration, metrics can also be associated with other elements of an integrated
risk management framework, such as products, services and business processes, to monitor quality assurance
and performance.
▪ Archer Bottom-Up Risk Assessment enables you to engage in targeted project risk assessments. Projects can be
documented and questionnaires can be created with custom questions and questions derived from Archer’s extensive
library of thousands of out-of-the-box questions. When risks are deemed too high, risk treatments and remediation
plans can be documented and tracked.
▪ Archer Operational Risk Management use case combines multiple elements of risk management activities, including
risk and control registers, loss events , root cause analysis, and workflow review and approval; risk hierarchy
roll-up and risk library; key indicator management; Top-Down Risk Assessments; Bottom-Up Risk Assessments;
Issues Management; and risk self-assessment campaigns (control self-assessments [CSAs], risk and control
self-assessments [RCSAs], and process, risk and control self-assessments [pRCSAs]).
Archer Operational Risk Management serves as an aggregation point for your organization’s operational risk management
program, enabling you to visually understand, prioritize and manage known risks and then expand your program. Your
organization can harness risk intelligence to reduce the likelihood and impact of negative events, lost opportunities, and
surprises and increase the likelihood of achieving your objectives in order to maximize performance.
Archer Operational Risk Management | 3
About Archer
Archer, an RSA company, is a leader in providing integrated risk management solutions that enable customers to improve
strategic decision making and operational resiliency. As true pioneers in GRC software, Archer remains solely dedicated
to helping customers understand risk holistically by engaging stakeholders, leveraging a modern platform that spans key
domains of risk and supports analysis driven by both business and IT impacts. The Archer customer base represents one
of the largest pure risk management communities globally, with over 1,500 deployments including more than 90 of the
Fortune 100. For more information, go to [Link].
©2020 RSA Security LLC or its affiliates. All rights reserved. RSA and the RSA logo are registered trademarks or trademarks of RSA Security
LLC or its affiliates in the United States and other countries. All other trademarks are the property of their respective owners. RSA believes the
information in this document is accurate. The information is subject to change without notice. 11/20 Solution Brief H13517-4 W427849.