Create a list of individuals who take part in the process. Draw a symbol of the person. Write a label describing their role or title. Draw lines with arrows connecting individuals who interact with each other in this process. Label the lines with words describing the interaction. Write numbers on the interactions to show the order they occur in. Continue this activity with the next critical process. NOTES: You can add follow-on processes to examine if they are identified as critical by the participants during this activity. Specifically, the exercises in the Threat Assessment section pair well. Put people on post-its to make them moveable. Verbally walk the participants through the completed process so you ensure you didn't miss anything. Take quick notes to remind yourself of any key points not clearly marked on the map before they move on to the next activity. After completing all the key events take a photo of the whiteboard / store the chart-paper for later documentation. Recommendation This activity can lead to feelings of hopelessness as well as stir up direct fears or challenges that the staff face. It is important to remind the staff that any risk can be mitigated, and indeed it is the goal of an audit to identify the highest priority ones based on actual likelihood and provide guidance on mitigation. RISK MATRIX Covered in full in Threat Identification: Create a risk matrix placing impacts against a range of likelihood. Clean up critical process maps for use in reporting. Create a list of all services or assets that were identified during the activity that were not already known by the auditor. CRITICAL DATA ACTIVITY Covered in full in Data Assessment: Page 144 of 240