PACE PMR SOP

Question 1

What is PACE?

Answer 1

Enterprise methodology for documenting business processes and designing controls with a view of obligations and business/customer outcomes whilst reflecting the risks in the processes.

Question 2

Do process models developed using PACE provide a powerful tool for understanding our processes and identifying opportunities and gaps?

Answer 2

Yes

Question 3

What are the 7 main steps of PACE?

Answer 3

1. Identify and engage key stakeholders
2. Document the process
3. Establish process objective
4. Analyse controls and confirm linkages
5. Create GRACE records for control gaps
6. Overlay controls and publish models
7. Maintain PACE certified models

Question 4

What are the 3 prerequisites that must be met prior to commencing PACE work?

Answer 4

1. PACE Coach assigned
2. Process scope confirmed (by PO/PMO)
3. Key stakeholders engaged

Question 5

Who are the 5 main parties involved in PMR activities?

Answer 5

1. Process Owner (PO)
2. Process Model Owner (PMO)
3. Risk/Obligation/Control Owner/Manager
4. DCO
5. PACE Coach and PACE SMEs

Question 6

Who is the first point of contact before a Risk or Obligation Owner/Manager is consulted?

Answer 6

DCO

Question 7

True or False: DCO is the first point of contact before the Risk or Obligation Owner/Manager is consulted?

Answer 7

True

Question 8

In the PMR, what are Process Owner (PO) tasks?

Answer 8

Accountable for signing off on process models/objectives and ensuring the correct controls are overlayed to the process.

Question 9

In the PMR, what are Process Model Owner (PMO) tasks?

Answer 9

Generally doing and overseeing the work that will be signed off by the PO (includes responsibility for documenting/updating models and objectives).

Question 10

In the PMR, what are Risk Owner/Manager tasks?

Answer 10

Consulted regarding controls in general (those existing, required, and gaps) and accountable/responsible for confirming the risks to be linked to the identified controls.

Question 11

In the PMR, what are Obligation Owner/Manager tasks?

Answer 11

• Accountable/Responsible for confirming obligations relevant to the Process Objective, and:
• Consulted regarding controls in general (those existing, required, and gaps) and accountable/responsible for confirming the obligations to be linked to the identified controls.

Question 12

In the PMR, what are Control Owner/Manager tasks?

Answer 12

Accountable/Responsible for analysing controls and identifying gaps/deficiencies.

Question 13

In the PMR, what are DCO tasks?

Answer 13

Consulted for everything except documenting models; first point of contact before Risk/Obligation Owner/Manager is consulted.

Question 14

In the PMR, what are PACE Process SME tasks?

Answer 14

• Update models and objectives, overlay controls, submit models for publishing.
• Refer to DCO / Obligation SMEs to confirm obligations relevant to the process.

Question 15

In the PMR, who is responsible for updating models/objectives, overlaying controls, and submitting models for publishing?

Answer 15

PACE Process SME

Question 16

In the PMR, what are PACE Control SME tasks?

Answer 16

Identify and analyse controls in the process and confirm obligations/risks to be linked to controls with DCO/Obligation/Risk SMEs.

Question 17

In the PMR, what are PACE Coach tasks?

Answer 17

Oversee all activities and certify models

Question 18

Who are the key stakeholders in documenting Level 4 Process Models?

Answer 18

1. PO/PMO
2. DCO Partner
3. Business SMEs
4. PACE Coach/SMEs

Question 19

For swimlanes, what is the bare minimum number of levels of hierarchy?

Answer 19

3

Question 20

What is the new swimlane hierarchy?

Answer 20

Group CEO > Division > Sub Division > Business Unit > Team > Role (minimum of 3)

Question 21

What 2 new things must be considered when documenting a process model?

Answer 21

1. Whether the process supports a Critical Operation
2. Whether any part of the process is subject to Continuous Monitoring

Question 22

In which folder must process models be documented in?

Answer 22

The Correct Process Hub BAU folder.
Do NOT use NAB Process Catalogue A-Z folders or the Drafted_Revisions folder to create or update process models!

Question 23

What 3 things must be included in the Process Objective?

Answer 23

1. Business Objectives (why the process exists and expected outcomes).
2. Obligations (only included if the process is designed to specifically meet element/s of the obligation that can be defined, and the obligation can be linked to a control embedded in the process, and the control does not have other obligations linked to it in GRACE).
3. Continuous Monitoring, if applicable (must note the specific part/s of the Process Objective being monitored and the relevant GRACE Indicator IDs).

Question 24

When can you include Obligations in the Process Objective?

Answer 24

1. Process is designed to meet specific element(s) of the obligation(s).
2. The element(s) of the obligation(s) can be specifically defined.
3. The obligation can be linked to a control that is embedded in the process, and that control does not have other obligations linked to it in GRACE*.

*The Obligation Owner/Manager determines the linkages to controls. If there are multiple obligations linked to a control, engage the DCO and/or the relevant Obligation Managers and Process Owner to confirm the applicability of obligations that are linked to the controls that are operating in the process.

Question 25

Why is the Process Objective considered a critical anchor point?

Answer 25

It helps the Process Owner determine whether the process has the right controls in place to achieve intended business and/or customer outcomes.

Question 26

Who are the key stakeholders for establishing/updating the Process Objective?

Answer 26

* PO/PMO * Obligation/Control Owner/Manager * DCO Partner * PACE Coach/SMEs * Business SMEs who operate the process.

Question 27

What are the steps for establishing Process Objective?

Answer 27

1. PACE engage DCO to obtain context of the process/obligations and tell who the Obligation Manager(s) to be consulted are. 2. PACE SME requires Obligation Manager(s) to confirm the obligations DCO say are required. 3. PACE SME meets with business stakeholders to walk through the process, document and confirm process objective.

Question 28

What is the purpose of step 4 'Analyse Controls and Confirm Linkages'?

Answer 28

1. Determine the controls that are, or should be, operating in the process. 2. Analyse control objecitves/operation individually and collectively to ensure alignment and support of the Process Objective. 3. Obtain confirmation of the required linkages to the controls in GRACE.

Question 29

What are the five steps in step 4 'Analyse Controls and Confirm Linkages'?

Answer 29

1. Work with Business SMEs to determine required controls. 2a. Confirm controls with Control Owner/PO/PMO. 2b. For undocumented controls - request Control Owner or Process Owner to create a new control record in GRACE so the new (draft) control can be overlayed to the model and analysed. 3. Analyse controls (individually and collectively, including drafts) to ensure alignment with process objective. 4. Report control deficiencies/gaps/misalignment to Control Owner/Manager to raise a GRACE Finding, remove the control, or address the control gap. 5. Obtain confirmation for linkages of obligations and/or risks to controls (first contact DCO or equivalent to learn who to contact)

Question 30

What should PACE do if an undocumented control is identified?

Answer 30

Request Control Owner or Process Owner to create a new control record in GRACE so the new (draft) control can be overlayed to the model and analysed.

Question 31

Who should control misalignments, gaps, or deficiencies be reported to?

Answer 31

Control Owner/Manager

Question 32

When control misalignments, gaps, or deficiencies are reported to a Control Owner/Manager, what should the Control Owner/Manager do?

Answer 32

Raise a GRACE finding, remove the control, or address the misalignment/gap/deficiency.

Question 33

When does inferred overlay of obligations and/or risks linked to controls overlayed to processes occur?

Answer 33

AFTER the model has been PACE certified and BEFORE the process model is approved by the PO/PMO.

Question 34

What does PACE certification indicate?

Answer 34

The process has been documented using the PACE methodology and has been over sighted by a PACE Coach.

Question 35

Can draft controls be overlayed to process models?

Answer 35

Yes, they must be.

Question 36

How long do PACE Coaches, POs, and PMOs have to approve PACE model approval tasks once received?

Answer 36

3 days (otherwise the model will be rejected from the approval workflow)

Question 37

Once a model is published, what must be done for draft controls?

Answer 37

The modeler who submitted the publishing request must notify the Control Owner/Manager that the draft control may be activated in GRACE.

Question 38

What are the 4 steps of maintaining PACE certified models (when a relevant trigger indicates the requirement of re-certification)?

Answer 38

1. Identify the model to be updated and the type of change required (based on the trigger event). 2. Understand the impact of the change on the Process Objective and engage others as required. 3. Review the process design, controls, and linkages to validate/update as required (obtain confirmation from DCO/Obligation/Risk as required). 4. Update the PACE certified model and republish

Question 39

What 3 things can no longer be overlayed at a task level

Answer 39

Controls, Obligation Instances, and Risks (they must be overlayed at the Diagram level).