Hi, I have been looking into modelling risks in relation to products for a internal business customer. I originally assumed that because risks could be related to functions and application system types, then you would be able to relate products to risks. But I have found that you are unable to create relationships between products and risks. Does anyone understand why this is the way it is? I understand that you can infer a relationship between risks and products thru relating them to the same function (in a FAD) but this method falls down when you have multiple risks and products associated with a function, especially when you add controls into the mix. To me, if you can relate a risk to an application system, then logically you should be able to do the same with a product. p.s. using ARIS version 7.1.478722. Thanks in advance

 or register to reply.

Notify Moderator