Business processes are what your organisation actually does: onboarding customers, paying invoices, managing access. Registering them ties your compliance work together. Each process is linked to the IT systems, vendors and assets it depends on, and to the requirements, policies, controls and treatments that govern it. That lets Diri show what a supplier or system failure means for the business, and lets you run a business impact analysis (BIA) on each process.
Open Vendors, Systems & Processes > Business Processes in the left-hand menu. Switch between Overview (cards with linked systems, vendors and governing items) and Table.
To register many processes at once, use Import, see Bulk import.
The process model splits the process into three phases: Input (what triggers the process), Process (which steps are performed) and Output (what is delivered). Each phase has two rows:
Use Add governing or Add supporting, choose the Phase (or All phases), the Type and the item. When you add an IT system, Diri also adds the system's vendor.
You can link a process phase directly to the controls of the frameworks your organisation has activated. This shows which compliance requirements an operational process answers to.
If no frameworks are activated, the picker says so and links to Frameworks. See Frameworks. A business process can in turn be linked as evidence on a control, see Controls and evidence.
The BIA, shown in Diri as the Operational Exposure Assessment, scores how exposed a process is if it is disrupted: how critical it is, how quickly it must recover, how much it depends on vendors and systems, and how well it is governed. It is one of the pre-assessments, with the same treatments, approval and history.
The score (0–100) is built from four sections: Business Criticality (35%), Recovery Exposure (30%), Dependency Risk (20%) and Governance Maturity (15%). The bands are Resilient, Manageable, Exposed and Critical. Open the result with BIA Score on the process row.
The BIA reads the vendors, IT systems, policies and treatments linked to the process. If one of them changes after the BIA was scored, the result shows Scored on records that have changed. Open the assessment and save it to score it again.
When the BIA shows high exposure, start a full risk assessment of the process with Start risk assessment. The button is available once a BIA has been completed. See The risk assessment process.
Business processes also feed the dependency analysis: when systems are linked to processes, a what-if simulation can show which processes stop, their highest criticality and their shortest recovery time.
A business process can be offered to sub-organisations with the Use inherited and Can modify toggles. A process inherited without permission to modify is read-only in the sub-organisation and is edited in the organisation that owns it. See Inheriting and sharing.