Homes England - Automated Risk Management System (RM1557.12 G-Cloud call off)

Homes England require the following:

Automated risk management system consisting of the following modules:

Risk Manager

Controls (Compliance) Manager

Incident Manager and related support services in accordance with the relevant service descriptions including 24 days for implementation and an optional 20 days on a call off basis for further development and or implementation requirements and as further set out below:

Risk:

Risk Manager standard features:

• Risk Capture with Inherent, current and target risk scoring

• Risk approval and closure workflow

• Multi-level risk taxonomy (managed by Buyer administrative staff)

• Multi-level Risk register hierarchy (managed by Buyer administrative staff)

• Key Risk indicator management

• Risks linked to controls in the controls framework

• Risk Events capture

• Mitigation action tracking (utilising your existing action tracking module)

• Process mapping tool with ability to overlay risks and other content

Buyer specific features:

• Ability to score risks on multiple dimensions. E.gdifferent weightings to different risk score factors, and possibly utilising inputs from Control scoring (Requires clarification of HE's methodology - may not be a day 1 requirement)

• Strategic objectives changed to 'demand drivers' with ability to copy this categorisation through to linked controls

• Risk events added (possibly merged with data breach reporting in IAM depending on agreement with the HE DP team)

Controls:

Controls (Compliance ) Manager standard features:

• Controls Framework to model Buyer control environment, including:

• Controls, linked to Organisation, Process, Sub process, risk, entity.

• Controls linked to control objectives management

• Change control

• Control confirmation tasks

• Control design effectiveness testing by first line, with 2nd line assurance review

• Control operating effectiveness testing by first line with 2nd line assurance review

• Control testing deficiency management

• Action management (integrated with the existing action module)

• Self-serve reference data management (e.g. for process, sub process, entity and org structure, user permissions etc)

• Ability to manage / test controls independently of Risk linkages

Buyer specific features:

• Ability to mark a control test status as a Partial Pass (where mitigations are in place that mean the control is not strictly a fail. Note this may also be able to be supported via a

'pass' with mitigating actions attached

• Ability to scope tests by 'demand driver' (inherited from

Risk)

• Specific reporting dashboards (requirements to be Future Features (when Buyer requirements are known):

• Ability to score controls through the testing process and use this to compare against risk scores - the aim is to surface controls that may not be proportionate to the risk they are controlling

Incident Manager:

Incident Manager centralises the recording, resolution and reporting of incidents / problems across your organisation

Tender Documents

• Awarded contract notice on Contracts Finder → — Award notice