all right how is everybody hope you're doing well um and thank you for joining us you know we are really excited to to be here to talk about risk management and I am very excited to be joined by our illustrious senior manager of product management karsh a good friend of mine who I've worked with for quite a while now Hollywood Kush hi everyone hi Jessica good morning good evening good afternoon yeah we have people from all over don't we yeah absolutely all right so before we get started we're going to do a little bit of housekeeping you all are automatically placed on mute but we want to hear from you if you've done these before with us you know use the Q a panel we love to make this interactive we want to get your questions answered um this will be recorded and I will be putting the link in the chat I'm a little bit later on to the playlist um so it'll be up in the next day which um a little with a bunch of other ones that we've also done and um so lots of good information there so check that out for sure um you guys all know why we're here right we we released our new our new applications in the store so we're here to celebrate um we're here to tell you all about it Luke harsh is going to run through some cool slides but then he's also going to give you some amazing demos and you know we've already done BCM we've done third party risk we're going to do risk management today and if you haven't yet signed up for our compliance case management and our policy and audit management and some of our core new floor features please sign up I will again be putting a link to the uh the registration page in the chat a little bit later and um I think without further Ado woodkosh has a lot to show us so we don't want to take up too much time up front I'm going to turn it over to him and let him go through and and show us all the neat stuff in action absolutely so let me share my screen and yeah I can you confirm if you can see it now it looks great awesome so I'm really excited for this released uh here and and I want to take this opportunity to thank all of all of our partners and customers for constantly providing us feedback and this at least I would actually dedicate it to you because if you look at most of these announcements you have done is actually a response to what they asked for right so for example the first key one that I'm talking about is Target risk assessment and I know a lot of customers there were 20 plus customers requests either by a partner or directly by a customer just for this feature right so what it is is create really a future risk assessment saying okay I've done my internet risk I've done my residual risk but what the future profile or the ideal profile of the wrist should look like is what customers are doing and one of the interesting Trend actually I've been seeing in the industry is people are going away from doing inherent assessment and residual assessment and moving towards residual and Target so that's what you want to make sure we are supporting our customers and making that Journey so in the past if you were struggling to model let's say doing a Target risk assessment it's gonna be a cakewalk now with Advanced risk assessment the next key capability I'm going to talk about is the configurability element in the advanced risk assessment experience and this is again based on all the feedback that the implementation Partners our customers provided in the next experience where they said while ARA is great and it offers all the configurability in terms of modeling our assessment methodology we could do better in terms of actually giving customers more control over some of their war base that is seen on the UI so so I'll talk about what all we have done there and how we are further empowering our customers to tailor the risk assessment platform that we provide us for their unique needs the next key one is really on the metrics we have been making a lot of investment in this area so for those of you who have not yet explored this functionality or who are still uh let's say evaluating it one of the I would strongly suggest to actually look at it uh in terms of monitoring your Kris your kcis and one of the feedback that we got from customers again is if I have a lot of data points that I have to provide for metrics you know a bit cumbersome to provide each of them in let's say it's a form by form or record by record basis so there's a new grid UI that is enabled now for those of you who have seen our ESG solution probably may have seen this UI but the same UI is now enabled on the risk for space and the employee Center as well the next key announcement is really around the guided experience for setting up your risk assessment planning right so again what we did there is based on pure feedback that we got from our customers where they've said that the first line should manage their RCS is and one of the critical activities in management of those rcss is definitely looking at let's say setting up the risk assessment plans and making sure uh the risk assessment scope is well defined and you can do it at scale through a risk assessment scheduler so we are leveraging something called as a playbook for that corresponding capability so what I'm going to do is I'm gonna go for your capability by capability and I'll just try to maybe summarize this in five minutes here on the deck but I want to spend more time in the systems focusing you what we have done right so so those are always exciting to see things in action rather than these PowerPoint decks so some of the key highlights that we have taken care when we talk about the target risk assessment is similar to your inherent and your residual risk your target risk assessment also I suppose you complete flexibility in terms of what your factors are going to be on which you are doing the target risk assessment what your scoring Logics are what your rating criteria is how should the heat map look like so all that power that was given to you during your inner end and residual assessment the same power is given even for the Target responsibility in addition to that one of the key insights when we are speaking to our customers we got us not always Target risk assessment may make sense right so if the risk is already let's say within the appetite you're you don't have to take any further actions on that risk what do you not to do Target risk assessment so that is where we are making or the giving that power to customers to Define rules as to when Target risk assessment should be performed or while when it is optional in nature now when you do the target risk assessment you can also compare what your appetite status is gonna look like since your target risk again can differ from your appetite it may or may not be in line with your appetite right because in certain situations it may be just too costly to actually reach that appetite level and for those business reasons may you may still want to have the ideal state of the risk not within your appetite but what we are doing is we'll be able to compare and see your target risk value is it gonna be Beyond within the appetite or not so that gives you a future projection in a sense if you really truly reach the target I is this risk gonna be within an appetite helps make the risk assessor and the risk owners make a better judgment of it now once your target assessment is performed the system will also automatically do a roll up or aggregation of these risk across your risk hierarchy across your entity hierarchy or a pivot between the two if needed now one of the key things apart from that is also making sure you are able to visualize these Target risk on the heat map right so you are able to understand the trend you are able to understand the movement of these waves that is there and this functionality is available to all our irm professional and Enterprise customers so if you have advanced risk entitlement you should be able to use this capability awesome well of course we've got a quick question here I think um people are probably wondering a lot of people are wondering this um the inherent assessment that that's not going to be phased out or replaced by the residual and Target assessments you're still going to be able to use it in the future right we're not taking anything absolutely absolutely I'm just talking about a trend test of where I'm seeing a lot of customers are actually making it optional in their organization to do uh inherent assessment and they're just focusing on residual inner target but since we support Global customers there are still a lot of customers who do all three so we're gonna have people all three yeah yeah yeah no I think that's good I mean I think it's also interesting for people to hear where other customers are going you know that's that's always valuable awesome so what I'm going to show is now how the target risk assessment looks like so I'm going to impersonate as a risk admin here just give me one minute while I try to log in into the system so many I think this the target risk assessments can be so valuable you know honestly I think it's it's such a powerful tool yeah I mean I I I was speaking to a lot of our uh pack customers for example and a lot of them actually categorically said this is something that we have been either already doing and uh we were trying to see how do we actually do it in the tool or we have been looking to do to catch up with the trend because like I said this is a very very interesting Trend uh or a change that I'm seeing in the risk assessment world yeah okay so so let's look at one of the things around Target risk assessment now a lot of you may be wondering if you want to consume this capability it means you may have to republish the risk assessment methodology right because you once the methodology is published assessment is published we can't actually enable it here's the good news we actually figured out a way for making enabling this even for your existing methodologies so it's going to be a one-way Journey where if for a particular methodology your target risk assessment is enabled and you have done some assessments you will not be able to switch it off because then the data consistency is lost if you switch it off but at least even for your existing methodologies you should be able to turn it on now the advantage is if you have taken workarounds to actually do Target risk assessment you can maybe descope those customizations or walk arounds and actually use out of the box for your existing methodology without losing data so so very important factor we are taking again your feedback saying we have to make things more configurable in terms of even the assessment methodology so so that's it's a step in that direction itself so now if you see in this record here the target response disabled now I enable it and let's say if I want to go maintain the target I can open the target risk assessment that is getting enabled here and I can specify how the target assessment is performed now a lot of times your target risk may be uh similar as your residual risk or it may be same as your inner interest right or you may just want to do a simple assessment of sort saying okay I don't want to do Target risk based on individual Factor values but I'm going to do Target risk based on low medium high kind of overall rating skills so depending on what your preferences will support you in that Journey so we have provided you all options here so now if you have a residual risk where you are doing a factor based assessment apart from these two three options you will also get Factor same as residual now what this does is it saves you those extra clicks that you want to make to actually copy over the corresponding setup that you have done in your inherent assessment so all you can do is just specify what my heat map looks like and if you see all of the rating and the factors are copied over from your inherent risk into the target risk profile right so so I know my target risk assessment the I do it is very similar to how do I do my uh in her interest and then therefore I don't have to specify this here the other key thing that I want to highlight is remember I was talking about when do you want to enable disabled Target risk assessment how do we make sure that let's say risk assessors are not overwhelmed of doing of Target risk assessment when it's not needed and again it's based on the Insight that a lot of times when your risk is within your appetite you may not want to do a Target risk assessment so what we did for this is we've provided configurability for you to specify those rules so for example I can say if the final residual risk is poor is let's say uh greater than maybe six right as an example then only I really want to do a Target risk assessment so so that's something I can easily specify and make sure that my organization policy right whatever it is is actually taken care so I'm gonna just save this across and publish it save it publish it across and that's all I need to do let's say for existing grants if you were supposed to enable Target risk assessment that is all you have to do quick things quick recap you specify how do you want to calculate Target risk and you can have qualitative quantitative whatever is your mechanism of actually doing Target risk assessment you specify the heat map if Target risk has heat map unable you review the rating criteria the heat map configuration and click on publish action if you want Target risk assessment we always perform if you want in certain situations people to skip that Target risk assessment you can specify that condition here right and here you will also get a script option so if you have more complex logic that you can actually not build via conditional buildup here so you can actually use those script options as well so the complete power is given to you to model your organizational business requirements for doing this yeah that makes it that makes it pretty straightforward we do have a question that showed up in the chat um and I noticed something as you were doing this the question is there are there are certain fields that are actually required as you're going through that and the different tabs um what I noticed was when a field there's a required field wasn't filled in there was a sort of an asterisk on the left hand side of the tab of the name so you know the question is how do I make sure that all the required fields are filled in without having to go through all the different tabs I think I'm thinking if there's no asterisk next to that name then you've caught all your required Fields if there is um kind of like it showed up like I'm looking at business validations here but kind of to the left of the business validation name in that tab then I know there's still some required fields in there to yeah I thought that was very clever I actually had not noticed that before should ask the question yeah yeah no absolutely and and we all we I mean there's something we we can further and improve on is the back end UI or setting up the risk assessment methodology so that's also something that I've already started looking at trying to see if how we can simplify that experience and improve it because we just don't want to let's say help our end users but also our admins set it up manage it more easily so so that's definitely something we are looking to enhance in the future releases now let's say you did the setup and everything here let's see on the front end right on the risk assessment record how does the Target risk assessment looks like so now what are the risk assessment where I have the target risk assessment is let's say 117. right so I'm gonna search that quickly and make sure that I have that okay so now if I go into my assessment let's say this one you know so now if you see you have your internet assessment you have your residual assessment and there's a new block here called Target assessment which was not available earlier right so so now for those of you who are wondering why don't we have a control assessment because in this particular assessment methodology I have control assessment essentially switched off but if I open up a methodology which has control assessment let's say I pick this one up here you can see all four of them now so earlier there was just three inherent control residual now you also have Target assessment and if you have a train that is available you can even see the trend of nrn control residual even on the right hand side panel if you have data and that I'll show you once you have an assessment published how it looks like so you'll be able to see the previous ratings of the target risk and stuff like it so so now one of the things that I talked about is let's say you have your risk assessment being done so you did your internet assessment you did your controls you did your residual now my residual came out to be high with the score of seven and the rule that had put in is for this particular assessment methodology if my let's say a residual risk score is less than six I don't have to do Target assessment but in this case here because the score was higher than six the target risk assessment is enabled and I can do the target assessment similar to how you would do inherent or a residual assessment since I was having the exact same factors and inherent that's why you see all those factors here but again it is your choice it is the power to you to decide how do you want to do that Target risk assessment so so this is how you can do it similar to how you are doing your internet and residual assessment you see the system computes our overall Target risk scores and if You observe there's also this block around your current appetite is outside appetite but you know if you are able to reach the target State you will actually be within your appetite so this is the right target State let's say for this risk and the user can make judgment on it and that's when he can decide yes yes I know right now from a residual perspective I am fine but I want to be low and therefore I want to mitigate this risk further in order to reach there so you can Define that plan of action as part of your risk response strategy here so that remains as it is here okay now let me show you the part where you could dynamically skip it right so let's say now if I go back to my residual assessment and now let's say for this particular risk assessment record your your residual risk becomes slow I override it so now if I go into my target assessment you see the system is saying hey you're good actually You Don't Have To Do Target risk assessment anymore because you are yeah you don't have to mitigate this risk further because your your risk is already within your appetite so it's very closely linked to that concept of risket right there and it will help you actually make sure that the risk fourth line is defining if they are outside the appetite they are also defining the future state of the rescue I like how the spaceman is actually even really happy you know waving his hands in the air that you've achieved your app you've been within your appetite we we have a couple of questions um the first one I think I'll take the second one first I think um they they're they want they're asking if you can clarify why a Target risk assessment is needed is it to assess the risk against the desired State according to a risk appetite um they're trying to decide where it should be positioned within the risk management process yeah so so the way we see customers using Target risk assessment is primarily to capture the future or the ideal state of the risk right saying yeah we understand right now we are not yet there let's say we talk about this risk right recording fixtures business transactions for personal goals so now imagine you had bunch of controls but somehow those controls are not sufficient and therefore your residual risk profile is still beyond your appetite for the organization now what's your next course of action right so when you report this risk to the Senior Management they're gonna say hey look this is not something we are comfortable with can you actually tell me what are you doing about it so so you will capture your risk response you will Define the mitigating plan of action and what the outcome of that investment that we are making in putting those additional controls out is gonna make so Target risk assessment is helping you capture that benefit as well to say okay by actually working on those actions we are going to bring down the risk from a medium to a low and then this is the ideal state of the risk so then from a reporting perspective you are also able to report this is where we will be in the future once your mitigation actions are closed and it's it's a way to I was almost validate or confirm that the actions you're taking are having the desired effect afternoon absolutely so so a lot of times let's say ideally speaking if your risk responses completed you should be able to reach that state which means your physical and Target state may become similar right it may not happen let's say in a short period of time but that is where you want to be so your target value is the future value the ideal State value where you want to be from uh from uh actual goal perspective but but and this is very much focused on risk now I mean there's a question that came in that's that's not focused on risk but it it it is complementary to to what we're talking about here which is a policy exception process so you know this really has nothing to do with policy exceptions you know policy exceptions really are focused on the compliance process right just kind of like here where you know you're not within the right range that you want to be in your policy you know controls are not are failing you know so your part you need to look at policy exceptions and then you look at the remediation and you know what mitigating controls can you put in place to deal with your policy exceptions um or what needs to be done to be able to adhere to the policy so it's they're two really very different things um but again we're trying to help customers identify where they are out of of bounds essentially or out of scope um and help them and provide them with a way to track and and remediate and achieve their goals so we got another question I love all the questions um how does this compare to this is Advanced this is Advanced risk how does this compare to Advanced risk where you need to evaluate all related risks separately this is a singular targeted assessment this seems like it would be good to get quick or high level data into the system and then when is this available so this is already out so if you upgrade it to the latest store releases you should be able to use this functionality already now coming to the question I think the question was more intended towards does it also supports the object-based assessment framework that we have it does so your target assessment can also be done for that high level assessment do you do why an object-based assessment so I'm showing it in context of risk but the same thing is applicable there as well so if you want to actually use it in context of that you are absolutely free to do obviously the appetite is as a concept is very very Centric towards risk so that will not be there the future rapid status and repetite Status calculation but everything else is supported even for object-based assessment so then the last question um we noticed when you were doing this to hear it there's a comment section so you know is there a way to make that comment section mandatory um or optional depending upon what the customer actually wants so that people are forced to say why they're they're doing a certain action so we're looking at it so that's one of the feedback that we are looking at in the current release to enable we could not make that into the well a lot of key let's say configurable elements that we provided but that's one of the key feedback we are looking at in this past part of this release Here right so that person should stay tuned for the next release in in March yeah we are constantly innovating right making sure we are listening to customers and helping them do it better awesome so so with that I'm gonna showcase you also how it looks like on a heat map so now let's say I have my risk profile for my organization here and I want to see how the target risk state looks like on a heat map right so I'm Gonna Fill Up one of the methodology let's say Enterprise risk assessment and let's say if I'm looking at the same risk of recording fixtures business transaction not just your inherited profile I can also look at the Target risk profile and understand okay from a Target perspective where we are so you can see my target state of the rest seems to be really really in that uh bottom left zone so so that's why you see that value here while your inherent was on the top bottom right now one of the key things that customers always ask is okay can I see the trend how the risk has moved from inherent to residual to Target so now if you see this is where you were when you kick-started this journey around this race you moved into this place here right now but the idle state is here so you can clearly track down report it have that conversation with your Senior Management saying hey look these are the actions we are taking and this is where it's gonna land us so so this helps you essentially report these risks in fashion that the Senior Management understands and you have all the data that you need at your disposal right in this case kind of a visualization here similarly from an aggregation perspective if you are looking to see your aggregated risk Target risk value so apart from your inherent and control residual you'll also be able to see the aggregated risks course to understand again okay at an aggregated level are we looking if the first line in line with how we think about this risk uh and compare it with your script right again if you want to so that's also something which is supported here so those were some of the key highlights that I wanted to cover as part of the target risk assessment here any quick questions uh that uh we can answer we have a lot we have a lot of questions um you know they're really good questions um okay I'm not sure where to start here the uh the risk response plan should help speak to the Target residual State once the plan is complete have you considered merging the risk response of mitigate with a Target residual risk assessment the thought is if the plan is truly helping to address the risk there should be forecasting of the plan accomplishing the risk reduction so I guess this is another suggestion for a potentially a future feature actually it's a great segue to the next set of features that I'm gonna ask uh I'm gonna demonstrate so there is flexibility to say only if you are doing a Target assessment you should actually have the risk response strategy defined so you can do that linking if you want to in your organization using the new capabilities here that's perfect um let's see will there this will this be available in the risk overview and the risk overview PA dashboard to select yeah so this is part of advanced risk so so far we haven't uh So the plan is we're going to migrate all our dashboards to the next experience we haven't done this currently so so so that's something which is planned for the uh August 24 release plan really and as part of that release we'll make sure some of these dashboards also have the target trust profile there is there an easy way to show the score and only and only show the ratings such as low medium and high internet the inherent residual ratings so you want to only display I think the feedback it doesn't want a feedback to say okay well I want to only see the rating not see the score on that display right okay so so I'll take a note of that and we'll see when we can be enable it but I want to highlight that you have an idea portal for any such feedback or feature request you want to make please use the idea portal to log this and a lot of these things that you're seeing are actually coming in from the idea portal itself yeah we love it of course where we see the roll up is that what we're going to see the up that is correct that is correct okay perfect we're looking forward to that okay so the next thing is something I'm sure a lot of our power users and implementation Partners will love right so a couple of reasons back in the room release when we released the new experience around the advanced risk assessment everybody felt it's really good but then some of the configurability or the power they need right to make it let's say tailored to their organization in terms of the war base was missing for example very simple thing a lot of our customers they actually don't call it inherent control residual they may call it cross-controlled net right it's just a terminology thing right in their organization but because that terminology introduces a notion of retraining and it pushes back that option we got the feedback we need that flexibility too right to say okay uh I'm not calling it as an internet assessment I want to call it as cross assignment and here's the fun part right when it comes to risk they also said that certain teams call it gross and net and certain teams calls it inherent and visible so which means it's not a system by change right it is at each methodology level that you should be able to Define this across so that power as well is given to you now to say okay what do you want to call it do you want to call it inherent do you want to call it control uh for a graph or do you want to use any other verbage for communicating that kind of an assessment that you're opening so that's one I'll showcase to you how it works the second thing is a lot of feedback came in saying okay we don't want to allow business to select multiple risk response strategies they should select the Primary Response strategy so I should have the power to determine whether your risk response is single or is it a multi uh selector strategy there so we have given again the power to you within your risk assessment methodology record to say okay whether you want to have your single response by the business or you can still allow multiple responses the messages in the text that you see for example the text below the gross risk a lot of customers wanted to again modify the garbage so they wanted to change the terminology change the verbage make it more aligned to how the organizational uses right and the country of operation they are in so we have again given that power to you to define the messages the action text uh that you see everything is configurable on this screen here from that perspective now apart from this I see a lot of requests when you have your residual rails which is based on inherent and control had a complex formula which was not supported by some of the out of the box formula so they requested similar to how we do it on inherent control or or factor based if you could have an script option so that we can write our complex Logics of sort so that was the ask and that is also Now supported as part of this release the next thing is the point we were talking about right we don't want to have risk response defined always right you want to always make sure you only want to make sure if the risk is already Beyond within the appetite maybe no further actions are needed I don't want to have any further investment on it so you can conditionally essentially Define when should your risk response be defined and when is it optional so that power is also given to you so I'm gonna showcase now some of these enhancements that I'm talking about and show you how does it look like in the UI so now let's say I pick up one of these assessments and I'm gonna go into my class and let's say I picked up the assessment which is around ideas because of friend methodology because that's where I had configured my section level so while it may seem small it it is it was like an ass from 15 plus of our customers so all of them said no we want the control over the verbage for example now if you see a previous assessment UI we were seeing inherent and residual in this particular assessment methodology we are seeing gross and net assessment so now if you go into resume assessment as well so you see gross risks right and computed gross risk score result where is it coming from it's actually coming in from your assessment methodology so now if I go into my internet assessment all you need to do is let's say you want to reconfigure the labels that are displayed on the risk assessment UI all you need to do is click on this option called configure section terminology that you have here and if this option is selected and if you go into your inherent assessment you will see a new section called section levels where you can specify it so for example if I want to call it some dummy value called process demo all I want to do is change it across and if I refresh it it's gonna make that change as simple as that right so you have complete control over what your verbiage is and what you want to see on the UI so that's one the second thing is restricting your risk response to a single assessment is a technology now uh as two singles risk responses so for that I'm gonna show you another methodology so let me go into Enterprise risk assessment methodology version 2. and if you see there's a new tab for risk response configuration and in that there's a new configurability to say make risk responses single select now if you do this on the front end again and if I go into one of these assessments for this particular methodology here uh let's say I actually turn this out four one zero the three five I'll do a three nine yeah let's see if we do an assessment here okay this is not the right one with my bad I selected a wrong one here I should have selected risk assessment now let us say filter out mad sorry uh oh you're uh your rating is going down now as the expert here [Laughter] [Music] [Laughter] so let me refresh this allow people into id1 Enterprise risk assessment methodology 2. 1031 show matching and I go into one of these records you know you see now you no longer have radio you no longer have check boxes you now have radio button so it's a single response you can say yeah I want to mitigate this risk right if you want to edit the task you can go ahead and change it if you want to change the response and say okay I don't want to mitigate it but rather avoid it that's also possible so it's it's again power and configurability to all our customers given the different kinds of risk assessment we are doing and we want to support their journey of having a truly integrated risk assessment platform using this ER engineer so those are a couple of things that I want to highlight I'll take quick questions if there's anything before I move on to the next set of things here you know nothing so specific we've got we've got some great ideas that are coming in as a wonderful combo to read later and um I did put the link to the idea portal in the chat so those of you that have some amazing ideas you want to hear them you know please please use that awesome awesome so that I'll show you now what we have done to giving the power to configure the messages and the section text that are displayed so again on the risk assessment UI that you are seeing we got this ass saying Hey look we want to change the messages and the labels that you see so it's not just around the factors but people expect that from servicenow they'll be able to even modify that things so so what we did is we actually gave this power for example let's say if within the internet assessment and let's go let's search for maybe yeah here so let's say I want to change the subtext below the internet assessment and here so this is the text which is displayed as you assess the rest assuming there are no mitigating measures in place I want to change it to maybe assess the risk assuming when they run as well assess the OS when there are no controls right it's a simpler message Maybe for somebody in the first line to make sense of it now if I go into my assessment and I pick up that assessment here yeah and open this up let's say one of these assessments where you have inherent assessment here yeah and I'm going to refresh it see that's automatically change similarly I don't want to call it navigate to I want to call it maybe move to so all you need to do is go into the sale and change it to move to so even though a lot of this is as part of the implementation of advanced risk assessment the feedback we were getting we wanted to make sure we are supporting our customers and giving that complete control and of configurability so if you see move to controller system simple right so internationalization stuff like it is still supported so don't worry about that but you have complete control over what you want to see on the verbiage perspective I think it really helps organizations communicate especially with the first line yeah because everyone's got their own terminology and and this this gives them flexibility it's pretty easy to make those changes yeah I mean Gene management is the biggest friction in adoption of any do right and if you're making it hard with a different terminology it makes that even harder for Frontline to make sense of it so that's the feedback we got from our customers and they said we want the support from service now in order to make that transition more so so now I'm gonna show you what more power that we have given to our customers in terms of modifying or giving more flexibility in the residual risk scoring so now if you go into your assessment methodology again typically when we talk about a residual risk which is based on your inherent and control you didn't have the power to modify stuff from uh from a formula perspective how or have your own custom formulas but now as part of your residual risk assessment you also have a script option even though if your residual is based on inherent and risk and let's say you want to have a formula like twice of inherent minus control you can have it yeah so yeah I know a lot of customers again what they were doing was either using automated factors or they were trying to do some hacks just to make sure this kind of uh Power is of the formula can be modeled but now that is pretty easy to do in the system here so all again a small small things but it's gonna improve the adoption in terms of the go to market or reducing the pain that is there generally right in terms of adopting any new tool so this is a little power that I wanted to show you the last thing I want to demonstrate is the risk response piece right so so let me show you in context of one of the Rams so let's say I look at operational risk method management methodology and let's say similar to your target risk you want to make risk response conditionally military so you can build your conditions here so for example I can say your risk response is only needed if your residual risk score is actually greater than six so now what this does is on the front end similar to how the target risk was it makes the risk response completely optional for you I'll show you how it works in the system too so let me now go into the UI for a quick demo of this and let's say I pick up one of the assessments for my operational methodology and I pick up let's say this one you know I bring bribe and if you see here your residual risk assessment and the score of six right and therefore you are required to do your target or sorry your risk response is optional now but if I let's say change it and save it you would see now your and if I make the residual risk greater than six right so let's say I make it to nine or 16 whatever it is so your risk response is mandated now so making sure your organization whenever your risk is beyond your threshold you have that plan of action defined you're doing your target risk assessment so it reduces the need right for doing those manual checks that the second line is needed because all of this let's say in the world of GRC controls are already digitized in the system so all your business requirements that are their policies for your risk management are already codified in the system making sure that the first line is adhering to it so this sets things on an autopilot mode from that perspective for our customers do you have a quick question here are you talking about the different workflows and things like that um can you introduce a custom workflow similar to the inherent control and residual not as of today but would love to maybe understand the idea better in case they are seeing any other types of risk assessment uh then we can certainly look at it and see how we can enable it but so far we are only seeing inherent control visible and target from an industry perspective and for those of you who are not aware about our roadmap here and probably using Advanced risk assessment for generic assessments as well I would suggest to wait for that other assessment engine that is coming along where you'll be able to do all that so so that's why we are very very cautious and not enabling some of those genericity here because the purpose of advanced risk assessment was just focus on the risk assessment needs and make sure there's various kinds of risk assessment can be supported by this uh engine here that's perfect and I think a lot of those also you know talking about the idea portal you know in the ID portal that's going to help us as we're working on a new engine that's coming out to make sure that we have a lot of these features in here that people are asking for so I love I love the new I love the ideas keep the ideas and questions coming guys awesome so with that I'll move to some of the other things that we have done and let me open my deck here oh sorry so so we are talking about this manual Matrix so one of the one of the feedback that we always hear when we talk about metrics is we want to make it very very efficient for first line to bulk into Data uh uh in as many as less number of clicks as possible right so you want to make sure you're not asking the first line to do 100 clicks but probably 10 clicks to enter the data and for such an interface we felt like something like a grid UI which is similar very similar to excel would work really well so I'll show you an example of power cloaks and Fields so on the risk workspace and even on the employee Center you'll see a new icon here called metric class now if you click on this as soon as you open the star icon up or page up you'll be able to see all the tasks metric tasks that are assigned to you now let's say I'm supposed to respond to this metric here and do let's say multiple of these so I want to say this one is 15 right and I read and acknowledge this data saying yeah this is actually 15. if I can save it I move to the next one I say this one is a 20. and again quickly acknowledge it to your standard and understood the data and this one is a 22 right so look at how efficiently here I'm able to quickly provide the data because all of this various information right that metric data task individual task that was assigned to me as a user is now available in a Consolidated bulk input mode now if I want to submit it all I have to do is Select these various individual items and keep on the summit action here so all of the individual items here that are there those will be submitted so so this makes the job of users looking at this information is providing input or responses to multiples of such values very efficiently so so this is one of the key feedback that we got specifically around the manual Matrix responses for us the next key highlight is also changes in the risk assessment scope and scheduler so now if I go into my risk assessment score and scheduler you will see a significant change in the UI here so for example let's say I open up this corresponding record which is already in trumpet so what we this what what we got as a feedback is that guided navigation was somehow not working well because you have to switch between tabs and you don't know which tab to open and stuff like it and for that reason we have adopted a Playbook user interface for even for risk assessment scope and assessment scheduler so now this is a very guided experience for you where you start by specifying your assessment methodology selecting the entities that you want to assess then it takes you on a stepwise journey for you to say okay who's gonna be the assessor who's gonna be the approval for this now once you specify it if there's a reassessment frequency to it you specify that across and finally you can go and initiate all these corresponding risk assessments for your organization right so so it's a very guided experience making it easy for first line to manage their rcss completely end-to-end right so you don't have to manage it from a second line perspective but you are empowering your first line to manage it similarly on the risk assessment scope as well so now if there are let's say new Scopes that you're creating for example for a particular methodology let's say it risk assessment methodology let's say I select a particular entity so it's an rdsm is going to take me through a very guided experience here to actually uh say Okay first you find the scope across and then uh specify the risk that needs to be assessed so you can select the risk that point you want to assess as part of that Improvement and then move it forward from there similar to how you are doing on the Square scheduler as well as on the other user interfaces wherever you have Playbook so this again takes that pain of learning of let's say going through the documentation of understanding how the user system by providing you that guided experience across so those were the some of the key highlights that I wanted to cover and last thing you would notice is also some changes in the technical architecture so what happened is behind the scenes we got this feedback generally from everyone from all our workspaces that the configurability is not on par with what was available in the core UI so that's where there's a new uh template which we call it as a standard record page template which empowers all the now uh irm experiences which is not just risk but also compliance and audit so so there's something called as a standard record page that is used and in that standard record page if you notice there are visual changes in terms of having a visual icon on the top to say okay how do you differentiate between a risk statement QRS to a control objective and so on and so forth having a differentiation between the primary and the secondary summary Fields here so that's also available then you have record Watcher to making sure that yeah you can actually see uh who what other users are seeing this record and all this right power is actually giving in to workspace admin to change these values if they have to so so again that in that increases the configurability of this overall functionality for you so this is very very important for us because we want to ensure we understand that customers need that power that flexibility in the tool to tailor this these systems as per unique organizational Enterprise needs so you want to make sure we are continue supporting in you in this journey and please feel uh I would strongly suggest you join the next session if you want to have a deep dive into this anushree is going to cover it into much more details than I did today around some of these visual changes that we have done around this so so that's gonna be covered in the next session too uh for this that's an amazing segue um that's an amazing segue um because I just put a couple of of things in the chat to uh to share the links to upcoming webinars that are occurring um and we did have another question or two real quick that we wanted to get in um can you can we Define the risk response based on the residual risk value for example if the original was high then the user can pass to choose a risk response of mitigate yes that is correct so so we did not lose it like a response strategy level saying yeah this is a recommended response strategy but what you can do is you can say if the risk is let's say greater than six or greater than 9 you have to have a response because not always it may make business sense to force the first line to say mitigate I think that power still should be given to the first line because there may be business reasons why they can't do a mitigation though it may be a recommended approach there wonderful well I I really appreciate all your time the the demos were amazing you know thank you all for for for joining us and you know join us again next Tuesday for our compliance case management and then Thursday for our compliance and audit and core functionality thank you so much everybody have a wonderful day and uh some good feelings from me to you awesome bye bye have a good day good night for folks in India Secrets seem to find a way out the dark all the time the dirty details