Homes England - Automated Risk Management System (RM1557.12 G-Cloud call off)

Homes England require the following:

Automated risk management system consisting of the following modules:

Risk Manager Controls (Compliance) Manager Incident Manager and related support services in accordance with the relevant service descriptions including 24 days for implementation and an optional 20 days on a call off basis for further development and or implementation requirements and as further set out below:

Risk: Risk Manager standard features: • Risk Capture with Inherent, current and target risk scoring • Risk approval and closure workflow • Multi-level risk taxonomy (managed by Buyer administrative staff) • Multi-level Risk register hierarchy (managed by Buyer administrative staff) • Key Risk indicator management • Risks linked to controls in the controls framework • Risk Events capture • Mitigation action tracking (utilising your existing action tracking module) • Process mapping tool with ability to overlay risks and other content

Buyer specific features: • Ability to score risks on multiple dimensions. E.gdifferent weightings to different risk score factors, and possibly utilising inputs from Control scoring (Requires clarification of HE's methodology - may not be a day 1 requirement) • Strategic objectives changed to 'demand drivers' with ability to copy this categorisation through to linked controls • Risk events added (possibly merged with data breach reporting in IAM depending on agreement with the HE DP team)

Controls: Controls (Compliance ) Manager standard features: • Controls Framework to model Buyer control environment, including: • Controls, linked to Organisation, Process, Sub process, risk, entity. • Controls linked to control objectives management • Change control • Control confirmation tasks • Control design effectiveness testing by first line, with 2nd line assurance review • Control operating effectiveness testing by first line with 2nd line assurance review • Control testing deficiency management • Action management (integrated with the existing action module)

• Self-serve reference data management (e.g. for process, sub process, entity and org structure, user permissions etc) • Ability to manage / test controls independently of Risk linkages

Buyer specific features: • Ability to mark a control test status as a Partial Pass (where mitigations are in place that mean the control is not strictly a fail. Note this may also be able to be supported via a 'pass' with mitigating actions attached • Ability to scope tests by 'demand driver' (inherited from Risk) • Specific reporting dashboards (requirements to be Future Features (when Buyer requirements are known): • Ability to score controls through the testing process and use this to compare against risk scores - the aim is to surface controls that may not be proportionate to the risk they are controlling

Incident Manager: Incident Manager centralises the recording, resolution and reporting of incidents / problems across your organisation