Mapping activities and processes

1. Regulatory Concept & Core Standards

In this video we will work through a concrete decision: identify decisions that can create an unjustified advantage. The aim is to explain the criterion used and apply it to a workplace situation. We will start with the concept, move to the procedure and finish with a case to solve. A risk matrix is a recommended management tool linking process, potential breach, control and owner. A score is not an official legal decision. National duties must be tied to an Estonian source and the entity’s status, rather than a Portuguese RGPC template.

Risk assessment begins with actual processes, including spending, selection, permissions and information access. Organisation charts alone do not show who influences decisions. Informal practices may weaken controls.

Apply the following rule: Section 8 requires internal channels for state administrative agencies and their administered agencies, legal persons with at least 50 workers, and specified financial-supervision subjects. Municipal criteria include agencies with at least 50 officials or local authorities with at least 10,000 inhabitants. Sharing and third-party operation follow section 8 conditions.

2. Practical Implementation & Procedure

Map the start, decisions and outcome. Discuss practice with operators and compare it with instructions. Identify authority and checkpoints without unnecessary personal-data collection. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

The procurement procedure requires a committee, but one person actually drafts criteria and selects suppliers. Mapping reveals concentrated roles. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Is the organisation chart enough to understand process risk? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

No. Examine actual workflow and authority. Documents and practice may differ and require different corrections.

One mistake to avoid is: assessing only the formal structure.

Now apply the national rule to a second decision. A subsidiary adopts its overseas parent’s procedure unchanged. What must it check?

Identify the Estonian legal entity, activities and workforce. Check section 8 financial-supervision and public-sector rules. Link duties to sources and owners. A shared platform does not give every group worker access to every case.