# Innovative Approach to Conceptual Design of Enterprise Risk Management Software
## 3 Software Solution RMS
### Risk Assessment  
The process of risk management is represented in Figure 7a. It starts with entering basic risk data, such as risk name, type of risk to be assessed, risk that is recorded and not evaluated, opportunity, etc. ), linked hazards, risk description, risk source, date, risk owner, organ of escalation, etc. The basic data risk card has additional optional cards, including: risk classification card (Figure 7b), connections with elements of structures (Figure 8a), consequences (Figure 8b), measures (Figure 9a), and assessments (Figure 9b). Figure 6: (**a**) Structures; (**b**) Organizational structure (**c**) Processes structure. External and internal experts perform a team risk assessment while also training internal experts and improving the quality of the output. In this way, the experience of external experts is incorporated into the risk register while simultaneously improving the know-how of internal experts. Figure 7b shows a risk classification card in detail. Classifications can be made according to the following criteria: zone of influence, level of influence, time of influence, manageability, type, and influence on the mission and vision of the company. Each of the listed categories contains several descriptive options in the drop-down menus. Figure 8a shows the connections between the observed risk and the defined elements of the hierarchical structures (COSO framework). One risk can be associated with one or more elements within each of the defined hierarchical structures and vice versa. Figure 8b shows the consequence card. One risk can have several consequences, and a more detailed description can be entered in the RMS for each consequence. The card related to Measures (Figure 9a) is one of the more complex cards set up for each risk. It is necessary to point out that one risk can have one or more actions to reduce, mitigate, or eliminate the observed risk. For each recommended action to mitigate or eliminate the observed risk, this card defines:  
* the name of the action;
* the description of the action;
* the deadline for the implementation of the recommended action;
* the costs of implementing the recommended action; the start of action (pre- or post-event);
* method of action (whether it is for the purpose of reducing the consequences, or for the purpose of preventing, ignoring, urgent reaction, control, etc. );
* verification period;
* evaluation of the effectiveness of the measure (highly reliable, reliable, partially reliable, insufficiently reliable);
* the date when the measure was implemented;
* and the status of the action (whether it is recommended, approval in progress, approved, implementation in progress, realized, risk transfer limited or impossible to be influenced by the organization). Based on the entered data on the costs of the implementation of the recommended actions, it is possible to conduct later a le-factor (Investment effectiveness) analysis, on the basis of which we conduct the prioritization of risks by the effectiveness of mitigating actions. Figure 7: (a) Risk basic data; (b) Risk classification. Figure 9b shows the risk assessment card. The observed risk can be evaluated using four risk matrices, namely: risk to people (safety), risk to the environment, risk to property (assets), and risk to the reputation of the observed organization. Categorization by the x- and y-axes on these four matrices is different taking into account the different nature of the consequences. For example, for the safety risk matrix, the consequences are as follows: grade 1--minor injuries or health effects, grade 2--minor injuries or health effects, grade 3--severe injuries or health effects, grade 4--permanent disability, grade 5--death accident or serious injury (Figure 8b). Figure 10 shows the risk matrices per asset type of risk.