Standards mapping
Risk Core is built to serve COSO ERM (2017) and ISO 22301:2019, and its loss events follow the Basel Level-1 event types. This page maps each to the parts of the product that serve it.
COSO ERM (2017)
Section titled “COSO ERM (2017)”| Component | How Risk Core serves it |
|---|---|
| Performance | ERM Core: identify, assess and prioritise risks, respond, and see the portfolio — RCSA, Dashboards |
| Review & Revision | ERM Core: KRIs, loss experience from Loss Event, reassessment in each RCSA cycle, and the management review |
| Information, Communication & Reporting | ERM Core: dashboards and group roll-up, reporting cycles, the group monthly report |
| Governance & Culture | Reference data held in the system: risk appetite statements, risk taxonomy, RACI. The policy and committee work stays with the client. |
| Strategy & Objective-Setting | Reference data held in the system: risk appetite statements linked to KRIs and thresholds. The strategy work stays with the client. |
ISO 22301:2019
Section titled “ISO 22301:2019”| Clause | Requirement | Where in Risk Core |
|---|---|---|
| 8.2.2 | Business impact analysis | BIA in ERM Core — critical activities, MTPD, RTO, RPO, dependencies |
| 8.2.3 | Risk assessment | RCSA in ERM Core |
| 8.4 | Business continuity plans and procedures | BCP levels, Command and operation, Activating the call tree in BCP Core |
| 8.5 | Exercise programme | Exercise log in BCP Core |
| 9.1 | Monitoring, measurement, analysis and evaluation | KRI, Dashboards |
| 9.3 | Management review | The management review record in Dashboards and reporting |
Basel operational-risk event types
Section titled “Basel operational-risk event types”Every loss event is mapped to one of the seven Level-1 event types.
| Code | Event type |
|---|---|
| EL01 | Internal fraud |
| EL02 | External fraud |
| EL03 | Employment practices and workplace safety |
| EL04 | Clients, products and business practices |
| EL05 | Damage to physical assets |
| EL06 | Business disruption and system failures |
| EL07 | Execution, delivery and process management |
Regulatory context
Section titled “Regulatory context”Risk Core is designed for companies supervised by the SEC, BOT and OIC. Materiality tiers and reporting cycles are configured to each client’s regulatory calendar.