2Subject Areas

This chapter contains the following:

Risk Management Subject Areas

Subject areas are logical groupings of columns that contain data about Risk Management. As you create analyses, you select the subject-area columns that provide the information you want.

Financial Reporting Compliance has these subject areas:

  • Risk Management Cloud - Compliance Real Time

  • Risk Management Cloud - Assessment Results Real Time

Advanced Controls has these subject areas:

  • Risk Management Cloud - Advanced Financial Controls Real Time

  • Risk Management Cloud - Advanced Access Controls Real Time

  • Risk Management Cloud - Advanced Access Models Real Time

  • Risk Management Cloud - Access Certification Real Time

To create an analysis, begin by selecting a subject area containing columns of information to include in the analysis. For example, to create an analysis that displays records of overdue assessments, you would select the Risk Management Cloud - Assessment Results Real Time subject area.

The simplest and fastest way to generate an analysis is to use a single subject area. You can use more if one subject area doesn't contain all the dimension attributes and fact metrics you need. An analysis that does so is called a cross-subject area query.

Subject Area Folders

Each subject area may have fact folders and dimension folders. Folders may have subfolders.

  • Fact folders contain attributes that can be measured, meaning that they're numeric values.

  • Dimension folders may hold attribute columns or hierarchy columns.

    • An attribute represents a piece of information about an object. Values may be dates, IDs, or text.

    • A hierarchy contains values with parent-child relationships. For Risk Management purposes, only Perspective folders provide hierarchy columns.

Subject Areas and Star Schemas

Each subject area is built on a star schema approach. A star includes "facts" and "dimensions":

  • At the center of the star is a fact: something you can count. In the Compliance Real Time subject area, for example, facts about the Control object include the count of controls and the count of key controls.

  • Dimensions branch out from facts, and they define characteristics about the fact. For example, the Control object has dimensions such as Control Name, Type, and Frequency.

Risk Management objects have defined relationships to one another, and subject areas are built on star schemas that reflect these relationships. In Financial Reporting Compliance, for example:

  • The Process object is the hierarchical parent of the Risk object. In the Compliance Real Time subject area, a Process fact extends to dimension details pertaining to processes and to risks.

  • The Risk object is the hierarchical child of the Process object, but parent of the Control object. In the Compliance Real Time subject area, a Risk fact extends to dimension details pertaining to processes, risks, and controls.

  • The Control object is the hierarchical child of the Risk object. In the Compliance Real Time subject area, a Control fact extends to dimension details pertaining to controls and to risks.

  • In the Compliance Real Time subject area, Process and Control have no dimensions in common.

When an analysis reports on unrelated objects, be sure it includes a fact for each of those objects. For example, you're building an analysis that documents the relationships among object records. It includes Process Name, Risk Name, and Control Name columns. Your data includes objects that have the following relationships to one another:

  • Process1 is related to Risk1, which is related to Control1 and Control2.

  • Process2 is related to Risk2 and Risk3.

    • Risk2 is related to Control1 and Control2.

    • Risk3 is related to Control2.

If you were to build the analysis without adding any facts, however, it wouldn't return any values for Process Name. It would return one value each for Risk1 and Risk2, and for Control1 and Control2, but it wouldn't show their relationships to other objects.

That's because the Process star schema and the Control star schema aren't related by any common dimensions. To show the proper output, you need to include a process fact and a control fact. The Process and Control stars then have a relationship through the Risk star, and so the analysis would return the proper results. If you don't want the analysis to show the facts you have added, you can hide them.

Knowing the relationships between the objects you're working with is key to building analyses in Risk Management. Basically, if you find an analysis doesn't return the results you expect, try adding a fact from each dimension in your analysis one by one, until it returns the data you expect.

However, because facts are the center of a star schema and serve as a gateway between dimensions and other star schemas, one fact may override another fact and cause a join between dimensions you didn't intend. Your best bet is to start small, run your analysis, and add to it across dimensions so that you can tweak the facts required for inclusion as you go.

Subject Area Guidelines

As you select subject areas for analyses, keep the following guidelines in mind:

  • In all Risk Management subject areas other than Advanced Access Models Real Time:

    • Inaccessible Records and Worklists can't be combined with any other dimension.

    • Unassigned Perspective can't be combined with any other dimension.

    • Day Name attribute in the Time dimension, when queried with another dimension or fact, is displayed as a number.

  • In the Risk Management Cloud - Assessment Results Real Time subject area, an Assessment Results folder contains Assessment Result Details and Control Test Plan Results subfolders. These should not be reported with any fact other than Facts - Assessment Results.

  • In the Risk Management Cloud - Compliance Real Time subject area:

    • Assessment Details should not be reported along with Facts - Issue.

    • Facts - Remediation should be reported only along with the following dimensions: Issue Details, Time, and Fiscal Calendar.

    • Risk Analysis should not be reported with any fact other than Fact - Risk.

    • Process Action Item Details should not be reported with any fact other than Fact - Process.

    • Remediation Plan Details and Remediation Task Details should not be reported with any fact other than Fact - Remediation.

    • Fact - Remediation should be reported only along with the following dimensions: Remediation Task, Remediation Plan, Issue Details, Time, and Fiscal Calendar.

    • Remediation Task dimension should not be reported with any dimension or fact other than Issue, Time, Fiscal Calendar, Remediation Plan, Remediation Fact, and Issue Fact.

    • Process and Control related to a risk are displayed only when queried with Process Fact and Control Fact.

    • Process and Risk are joined through the Control Fact. To see only Process and Risk in an analysis (without Control), you must add a metric from the risk fact. (You can hide it in the analysis.)

    • Don't combine Perspective dimension and Survey Facts Results.

  • In the Advanced Financial Controls Real Time and the Advanced Access Controls Real Time subject areas, perspective folders apply only to results. There's no way to report on perspectives associated with controls.

Subject Areas and Default Joins

Subject areas have default joins:

Subject Area Default Fact Join

Risk Management Cloud - Compliance Real Time

Control Fact

Risk Management Cloud - Assessment Results Real Time

Assessment Result

Risk Management Cloud - Advanced Financial Controls Real Time

Incident Transaction Result Details

Risk Management Cloud - Advanced Access Controls Real Time

Incident Access Result Details

Risk Management Cloud - Access Certification Real Time

Facts - Access Certification

The default fact for a subject area determines the join to be used when you combine dimensions. To override that default fact, you add facts. For example, you may use the Compliance Real Time subject area to create an analysis that includes Process Name and Perspective. To see perspective values assigned to processes, you need to add a metric from the Process fact; otherwise, control perspectives appear. Note, there's no way to include perspectives for more than one of the Process, Risk, and Control objects in one report, since the fact determines the perspectives to be shown.

These tips also apply to cross-subject reporting, so keep them in mind when you create an analysis that includes dimensions from, for example, the Compliance Real Time and Assessment Results Real Time subject areas.