This version is currently released in the V6.2.5.32 build production installer for now.  It ships the V6.2.8 database with the V6.2.5.32 application server and client.  In a little while we will re-release it officially as V6.2.8, but we need to update all the marketing material when that happens – which is a significant effort and takes us away from adding cool stuff into the application suite.  We are absolutely flat out right now with work orders – so we are holding off doing the stuff that doesn’t help you directly – like new brochures.   There are a couple of additional new features that we are working on which will probably make it into the V6.2.8 official version – but essentially the V6.2.5.32 production build is the 6.2.8 release.  Any one that installs now will get an update notice emailed to them when the renamed 6.2.8 installer is released if there is anything different (other than the name) – and it will be just a matter of replacing a couple of files.

Unlike the beta stream, 6.2.5.32 ships as a full auto-upgrading installer and will become the new productions release against which the next auto-installer will auto upgrade your database.   The installer will take any version of RiskManager from V6.1.x up to the current 6.2.5.32 build and V6.2.8 database.

So all the cool enhancements we have been working on for the last couple of years that have been in the Beta stream are now in this new production release, with as usual some more stuff added.

Most of you have been enjoying many of these features for some time now because you have been taking the Beta releases, so the changes will seem more incremental than dramatic – which of course is the idea behind the frequent Beta release programme.   True to form, we haven’t stopped updating, the production release already has a Beta patch which will take you to build 6.2.5.34, but until the 6.2.8 renaming, we are updating the production installer every few days anyway.   The next production installer update will be out next Wednesday.  

There are so many enhancements being added across the modules it is easy to miss stuff, so after you install the new app turn on incident management (if you haven’t already) and take a look at what has happened to the incident system!   The version in 6.2.5 was written back in 2006 – and it was begging for some attention – well it just got it.   I hope you like what you see, but this is just the tip of the iceberg – the 6.2.8 engine has heaps more it can do with incidents and that is about to be unveiled over the next couple of releases.

We won’t run this next Beta stream so long this time – maybe just a couple of months because we want to wrap up the V6.2.x series and move onto V7

Our existing clients will know that our version numbering is a serious understatement of what is being added as we are likely to add an entire new module in just an incremental build number change – so if we are jumping from 6.2.x to 7.0 you can imagine the dramatic enhancements we have planned for next year. 

 Here’s a hint of what is coming:  You won’t be managing “risks” or “compliance obligations” for much longer – they will be Governance Topics.  You wont be asking “what can go wrong?” but “how can we achieve our planned objective?”.   All the V6 stuff will be there, and the V6.2.8 database has largely accommodated the V7 view of the world – so V7 will be an auto-upgrade  from V6 – so keep you maintenance subscriptions current because you’ll get it at no extra cost.  More on this new approach in later articles.

For now a couple of things about V6.2.8 / V6.2.5.32.   You will notice that a new risk type will be automatically added called “incidents” with a BG  of incidents and a BU of I-Well and Risk of I-Well.  This is the “incident well” for incidents that are otherwise “unattached” to a risk.  Don’t delete them – you need them for the safety module incidents handling to work properly and appear in all reports.    The I-Well is a generic risk for otherwise unlinked incidents.

The incident engine has a whole lot of different reportable event types in it now, as well as a method for tracking the reports action and a work flow of incident handling.  You can still design your own additional attributes and properties, but the current single table view is about to change so that their will be different sets of attributes for each incident type.

You will also notice that the certification / SOX / Sched7  system will insist on creating a “root” account of  “0000″ called “Root”.  Don’t delete this either – if you do it will be automatically recreated.  This is the root of your chart of accounts.  It will allow you to have several different “sets of books” in the chart for different organisations, etc.  All accounts ultimately descend from this root account.  The reason it exists is to ensure that there are no orphan account trees for role ups.

For those of you who have been using master-child risk/compliance relationships (which should be everybody, right?), the roll up engine now rolls up everything – that means that financial values, likelihood, impact, control, assertions, breach flags, etc are rolled up as well as the residual ratings.  (Not the sub tables though – like incidents or causes, except for assertions).  This means that the strange anomalies in bubble charts for master risks are no longer there, BUT you can not set master risk likelihood, consequence, control, assertion responses and ratings or financial values independent of their children once roll up is engaged.   In particular the assertions roll up will float all child assertions up to the master risk/obligation – with the responses according the to assertion roll up rule (so make sure these are set).  Breach flags in the master risks can therefore be triggered by breaches in children – or non completion of assertion responses.  This makes a lot more sense that the old way of doing it, but you might need to re-jig some of your structures a little if you have been treating master risks as just another risk.

This release also surfaces test plans for the certification/compliance module which have been brewing for a while now and are finally appearing.  Again this is a first taste of this stuff, with much more appearing as fast as we can get the screens done.  The 6.2.8 DB already has the tables in it for the soon-to-be-released parts.  For now you can create, design, schedule and manage test plans, and in a few weeks you will be able to record and review the test outcomes and progress as well.

We pulled the claims module back from earlier BETA release of a few months ago so we can do more work on it, but it is only temporary, it will be back in in the new year.   We simply have not had the time to get back to that with all the other client requests we have been working on.  Also we decided that there were some other modules that required attention before claims would work as intended – one of those is obviously incidents.

Lastly you will note there are three different kinds of governance topics – not two as in most governance views:

1. General Risks
2. Compliance / certification obligation risks
3. Compliance Topics/Events

We will eventually rename these but for now this is what they mean: general risks are either project or general “corporate” risks of a future event, compliance obligation risks are the risk of a compliance obligation not being met – IE. the risk of non-compliance, while compliance topics are the compliance events that must are either occurring and must be managed back to compliance or are likely to occur without if ignored.  Every governance topic can be seen  in any of these views simultaneously – as a general risk, as a compliance obligation, or as a compliance event. 

 The main difference between the two ways of looking at compliance is that a compliance risk focuses on strategies / controls to minimise the causes of compliance failure and hence the risk of non compliance, while the compliance topic screen focuses on actions required to remediate the causes of the non compliance and then the control “learning” from that experience.

The two views come about because of the slightly different slant arising from financial statements compliance – where we wish to be able to assert a level of confidence in (and be entitled to assume reliance on)  a set of values in the FMS  to a level of materiality, versus document compliance – legislation or policy  - where there is no allowance for materiality but where active remediation is a defence.

The names are not the best in the RM suite – and apologise for this in advance – but it comes from our need to marry the two different views of compliance where both types of client use the same terminology for fundamentally different ideas and approaches, and our desire to allow you to switch between the two views “live” . 

So what is currently in the RiskManager V6.2.x suite ? 

• Risk management – general and corporate
• Assessments and assessment outcome management
• Compliance obligations – legislation, documents, policies, procedures, etc
• Certification /SOX / Sched7
• Compliance events
• Document management for legislation, policy, procedures, etc, with risk maps and review reminders
• Insurance
• Incidents & safety
• Test plans
• Audit management
• Assertions / compliance questions (Indefinite length and indefinite banks of assertions/questions for each obligation)
• Multiple assessments of each governance topic
• Corporate planning with obligations linked to risks / governance topics
• Snap-shots / milestones (with support for ‘what-if’ using restorable milestones)
• Surveys, custom and control self assessment
• Review and responsibility control on almost everything with reminders
• Work flow
• Process – charting
• Custom scripting engine
• End user report writer + import/export engine
• Tree views with governance topics in multiple tree branches simultaneously
• Master detail roll up relationships
• QBE Topic Search
• Full granular – multi-user security controlling who sees what obligation – internal, AD, LDAP, NT-Groups
• Multiple risk modelling systems (formula or tabular)
• Works as a single user install or massively multi-user install with a tiny footprint
• Internal messaging and task management/tracking

This list doesn’t really do it justice because some of these could inspire entire sublists of features, but these are the “big picture” items.

 There is a new version of RiskMailManager available in each of your client folders and on the general product download sites.  The BETA12 package has also been updated and  re-issued.  This new version has been issued in its own package and the BETA12 packages have been updated for those yet to update.

To upgrade it simply replace the RiskMailManager.exe in the applicationfiles directory of your BPC RiskManager V625 server installation with the new file in the zip.  Discard the previous version – it is a blight on the world and does not deserve to be remembered. 

The revised RiskMailManager addresses a problem that may stop the template reader from loading your message templates under certain configurations.  All clients using RM Beta 11 or 12 are advised to update the RiskMailManager application, regardless of whether you are experiencing mail problems or not.

BETA 12 Warning:  BETA12 requires are complex database update.  If you wish to upgrade to BETA12 you are advised to request a customised database upgrade script or request us to do it for you.  Alternatively, wait a little longer for BETA13 which will include an installer. 

Read the previous post for the content of BETA12.

The V6.2.6 DB changes have actually been creeping into the DB scripts progressively across the BETA’s but the server and client have not used most of the V6.2.6 changes (or at least not required them) until this release.  We normally feed the major DB changes into the DB structure up to 12 months in advance of  utilising them in a client.  Only when the feature is required in production do we clock over the DB Version number.  (There is actually one DB feature that has been in the system since approximately 1998 that is still waiting to get to the top of the to-do list,  and in that case the code to use the feature is already written, tested and has been utilised in other production applications, but the anticipated requirement has simply not yet surfaced in the market place.) 

In V6.2.5.22  includes:

• Updated - Insurance policy management.  Intended for “Insureds” (holders of insurance policies) rather than insurers (issuers) or insurors (agents).  Insurance policy management holds details such as contacts, coverage, exclusions, history, financial data, and renewal information.  Each Insurance policy can be tied to a type of control which in turn can template, classify and optionally standardise strategies and controls applied to governance matters such as risks, compliance obligations, CR risks, and other governance obligations.  Insurance policies also link to incidents and governance matters (risks, etc.) via claims management.   This release sees the surfacing of additional data fields, new report views and connection of the insurance renewal reminder and review systems to the messaging system.
• Upgraded Email Messaging.  More internally tracked responsibilities have now been added as uniquely managed messages to the mail & message queueing system.  This is available regardless of whether or not you enable email dispatch through the BPC MailManager.  (IE. the messaging system and email tracking works regardless of whether the emails are actually being sent . )  Among the additions are document, section and insurance renewals.
• New - Risk Milestones.  A milestone is restorable a snapshot of a risk.  Milestones existed in BPC RiskManager from version 1, but with the move from Version 5 to 6 the milestones were dropped in favour of a much more expanded continuous audit logging system with dedicated search, a much expanded assessment tracking and management system and the existing restorable archives.   These facilities did most of what milestones did and provided a much wider range of additional capabilities for search, multiple concurrent users assessing risk,  and data extraction.  There were some things that the logging system, et al did not satisfy however, and that includes a simple way to deliver a chart showing risks at an instance in time, or run multiple “what if” analyses (and store the results in a restorable way, and returning to the official values).   So Milestones are back and improved, with milestone types, descriptions, dates, etc, and charts.   There will be lots more happening here over the coming months.
• New Milestone Charts – Track changes in I/C/R ratings over multiple years, etc.
• New Profile Chart – expands the display of assessments against I/R ratings to the current + 2 assessments allowing either 3 time based assessments or current self/reviewer, previous self/reviewer  and previous-previous self/reviewer assessments simultaneously.
• New Email Message Template reports.
• New Auto-Add feature for the Report Builder interfacing engine so that risk-system-administrator-end-users can add custom or rarely used views and tables to the reporting engine reportable data.  If you know the name of the table or view this feature will mine it and build a definition for ReportBuilder  (Report builder is packaged into every client).  Now nothing is hidden!
• New Views for assertion reporting, number capture, etc.
• Updated BPC RiskMailManager (Email message batching) to accommodate the new mail queues in this version.

BETA12 is on the client download site (you will need your username and password), but if applying the BETA12 patch we STRONGLY  advise you to contact us so that we can assist with the DB conversion.   There are a couple of messy changes to tables that are mirrored or version tracked and some new FK constraints that may require more personalised attention depending on your data.  

 Those preferring to skip the BETA’s and wait for the full installer that is shipped with the official release, should be looking about 1 to 2 month’s out from now.

The next BETA release – due end of next week – will include a big update to claims processing and the compliance obligations.

In this release:

RM Server

• AD Active Directory Authentication with Groups – AD LDAP and WinNT authentication is now supported in AD.  WinNT is faster and supports groups, while LDAP is account lockout “safe”  but may not be able to check group membership. 
• AD Active Directory Authentication account lockout on bad password bug fixed.  Under the WinNT where max retries are set on account logins in AD, the user will be locked out if an incorrect password is supplied.  In this case you can use the AD LDAP provider. Groups may or may not be available (use the test program to find out), depending on how the AD access rights are defined.
• AD Active Directory Authentication now accepts OPTIONAL canonical strings for DC filters.
• AD Active Directory Authentication now accepts a flag to select LDAP/WinNT ADSI providers.
• RM Beta8 Bug fix:  Strategies can now be deleted again.

RM Client

• RM Significant speed up in risk, compliance and topic solver screens on risk scrolling.
• RM Risk calculations now update the summary assertion group for each risk
• RM Risk calculations now update and display audit ratings separately from self and reviewer risk ratings
• RM Risk Audit ratings can now have form edit and reading visibility defined.
• RM Risk Audit assessments now display in a dedicated rating level and can be edited in multiple locations.
• DM Refresh of browser list after detailed document record changes fixed.  (Auto-Refresh after document record insert is not yet available. You will have to use reload until then).

BPC RiskManager V6.2.5.18 – BETA8  Desktop client installer has been uploaded to the download site for those clients that need a desktop installer for internal distribiution on local networks. 

The file you need is :

BPCRiskManagerEnrimaV625_18Client_Setup.zip

You will need to unpack this and deploy the enclosed exe to whichever location/solution you are using to push desktop installers onto remote desktops.  The enclosed exe is a signed windows installer.  It should be recognised as an upgrade to any existing Build 14 install, but you can also uninstall the wny existing desktop and run this install as a fresh install as well.  Nothing will be lost on the desktop.

Clients patching full single user installations on desktops will need both this zip and the BETA8 zip to fully patch their desktops, although only the enterprise BETA8 zip is actually required to actually use the single user install.  

The patch in this update contains ONLY the desktop client for use where users do not have a full single user install on their desktops.  While you CAN install the client portion of the single user app with installer in this blog post, the result will mean that the desktop can talk to the remote server, but not the local server, until the server is also updated (from the BETA 8 zip).

There are no new capabilities in this update.  If you need an activeX version of this client build let us know and we will generate it, otherwise we might let it wait until BETA9.

Use your client credentials to login and download as usual.

In this release:

RM Server

• Active Directory Authentication with Groups is now supported.  You can group all your RM users into a common group and authenticate against AD and that group membership. The AD solution avoids ldap so you do not need a dedicated bind account.
• Business Group/Business Unit reassignment.  You can now move a business unit with risks to a new business group, and all business unit level access rights will move with the business unit to the new business group.

RM Client

• Document and Sections can be created by copying and pasting between XL and the RM Client App.
• Risks / Topics / Compliance items can be created using copy / paste from XL (or other tab delimited column source)
• Risk Causes can be copied from one risk and pasted into another, or copied and pasted to and from XL
• New DB repair component with automated repair actions available to administrators from the client.
• Revised MS Word automation options and behaviour when the MS SpellCheck is used to eliminate a bug that allowed the RM Client to terminate MS Word instances created after RM has started without save when RM is shut down.  The new handling is NOT engaged by default, but is available from the My Settings panel.
• Fixed a bug that prevented documents from being added if there was not at least one document already in the RM database.
• Fixed a bug that defaulted the first document in the document centre list to section insert mode if there were no sections in the document

So we are Windows 7 ready, and for those of you enquiring about SQL Express 2008 support and IE 8; the answer is yes – it works and is supported by BPC.

One thing to note during the Express 2008 install on Win 7 RC is that you should not run the Express 2008 data after installing, until you have also installed the Express 2008 service pack. If you install the Full Express 2008 version or the Combined installer (with the Studio Manager and the Database engine packaged into the one installer), the Win 7 installer will warn you that parts of the Express 2008 install are incompatible with Win 7, and that you will need to install the service pack. At the end the Win 7 automatic updater will find the service pack and tell you that the service pack is incompatible with that edition of Express 2008 (and refuse to download and install it). That is not correct, but you will have to go off to the MS web site and download the service pack manually yourself, and then run it. After that you can start up studio manager and the database (after rebooting the machine) and everything is hunky-dory. No doubt this will be fixed by the time Windows 7 comes out for production release.

Vista users will find Windows 7 to be very familiar, minus the annoying UAC pop-ups. XP users will find it is still a bit of a jump, but not as painful as the Vista jump (or maybe I m just getting used to the Vista interface).

One noticeable difference for us, is that the IIS web server both installs differently and has a different range of options available. If you will be using the survey and other web components in Enrima, you will need to install this, as it is not installed by default. You can install this in the native Win 7 mode (i.e. we do not need IIS 6 compatible mode). As always you will need to allow unrecognised ISAPI extensions for the libraries to run.

Feel free to give it a try. For those of you with a single user license of Enrima, you are welcome to test Enrima out on a second machine running Win 7 Release Candidate. We will ignore the license breach on Windows 7 RC, and you are welcome to contact support if you want to be hand held through the install process (although – as always, it is automatic, and runs the same as it does on XP, Vista, Windows 2000, Windows 2003, etc).