The new Process Risk simulation capability for ARIS brings together techniques that have been profitably used for many years in other spheres with the GRC solution. Fundamentally process simulation is about reducing the risk of change and improving the performance of a business through its processes.
In process change the concept of Risk operates at a minimum of two levels. Firstly, at the project level. Here risks are evident in terms of project management, going over-budget or late implementation and also there is often a real risk that the new process will not deliver the benefits claimed. These risks are at the project level and simulation has been regularly used to inform and remove this type of risk from projects in many sectors.
The second level is the risks within a process and it is here that the new functionality developed for Process Risk simulation as part of the ARIS Business Simulator has its origins. Simulation is distinguished from spreadsheet modelling in that it explicitly represents the process; including random events, dependencies within the process, feedback loops and data which changes dynamically over time.
A traditional simulation model of a manufacturing process would often include data as to the likelihood of failure at a point in the process, the failure being an equipment fault or the production of a sub-standard component. Manufacturing processes would include test equipment and repair loops to put right faulty work and maintenance teams to repair equipment.
Data about the reliability of equipment or the quality of an individual process step can be gathered by the analysis of historical production records and applied to the specific step within the process model. The influence of this quality data on the overall process performance is then apparent when the total model is simulated over an appropriate period i.e. a week or a month. In a real world manufacturing industry simulation there are many such points (risks) in the model where reliability or quality data is applied. The facility control rules, production schedule etc determines the flow of parts, in this case engines, through the facility. The aggregate effect of all the points of risk can be evaluated. Through structured simulation experimentation the cause and effect of extra quality checks or improved equipment can be evaluated in terms of overall process performance.
In a similar way to the application in manufacturing, simulation has been widely used to help improve processes in Government. An area currently in the news at the moment in the UK is the Criminal Justice system which is extremely complex with interaction between different agencies, Police, Prosecutors, and Courts etc. The end to end process of offence, through investigation, arrest and appearance in court does have a number of potential weak points where failure can occur, i.e. the risk of evidence being incorrectly gathered.
Simulation even of such a large complex systems can be used to predict the overall performance taking account of resource constraints, load and risks. The simulation technique is also applied to processes in financial and insurance organisations. In this sector in particular there has been a focus on process risk because this aspect is both fundamental to the profitability and health of the organisation and can be a statutory requirement.
The generic capability of simulation has been extended for Process Risk analysis. In a similar way that simulation is used to model quality defects in manufacturing processes it has been applied to modelling risks in business processes. These risks, either structural or due to system, data or people errors can have different impacts on a process normally measured in terms of costs and they can be mitigated by extra processes known as ‘controls’. This is very powerful for financial, retail and internet trading companies as risks can now be simulated as part of their processes and not as standalone financial models independent of the process. This means a valid prediction of process performance can be evaluated and informed decisions on the instigation of controls or process design can be made.
For more information on risk management topics, visit www.grc-lounge.com.
