[ Enterprise cybersecurity ]

myCyberRisk

Making risk workflows
clearer to act on.

PETRONAS’ enterprise cybersecurity governance platform, expanded across Compliance, TPRM and ORA.

Platform scope
3 new modules
Responsibility
UX workstreamsEnd-to-end design
Delivery window
3 monthsUAT to production
myCyberRisk TPRM assessment listingmyCyberRisk ORA risk overview
Scroll to explore

[ Overview ]

One platform.
Three new modules.

myCyberRisk is PETRONAS’ enterprise cyber risk governance platform, extended through this project to support new assessment, review and approval workflows.

Timeline
Jan – Mar 2026
Duration
3 months

New project scope

Three governance modules

Compliance
Evidence submission, review and audit findings.
TPRM
Third-party cyber risk assessment and review.
ORA
Operational risk acceptance and approvals.

My role

Leading UX and UI design across three modules.

I led the UX work and developed interface designs for Compliance, TPRM and ORA: clarifying requirements and workflows, defining interactions, preparing detailed screens, and coordinating with business analysts, developers and PETRONAS DesignOps for review and handoff.

My design responsibility was end to end across the three modules. Business approval, development, UAT and release remained shared responsibilities of the wider project team.

challenge

[ Challenge ]

Complex workflows.
Compressed delivery.

Fragmented manual governance and role-specific approval paths made status, evidence and ownership hard to follow. Initial requirements left workflow responsibilities and transitions unclear before build.

Fragmented ownership.

Evidence, requests and approvals lived across spreadsheets, email and shared documents. Status and ownership were difficult to follow.

Different roles, different decisions.

Reviewers, approvers, respondents and other roles needed distinct actions, permissions, histories and traceable decisions.

An unclear route to build.

Initial requirements needed a clearer account of who acted, how information moved, and how related actions changed record states. These relationships needed a shared interpretation before implementation.

Delivery reality

Design and development had to progress in parallel.

The project allowed limited room for extensive discovery. UX needed to clarify essential flows early, make buildable decisions, and respond to governance reviews without losing the delivery window.

approach

[ Approach ]

From user stories
to shared workflow logic.

I compared the initial BA user stories against the agreed MVP, then mapped the workflows with business analysts and developers to make responsibilities and decisions clearer.

01 / Check the starting point

Compare stories against the agreed scope.

The initial stories described features but did not yet connect them into coherent workflows. We needed to clarify how information moved between screens and stages, who acted at each step, and how those actions changed record states.

02 / Make the workflow visible

Map roles, states and handoffs together.

I created cross-functional swimlanes for Compliance, TPRM and ORA to connect roles, actions, record states and information movement. The BA and developers used these maps as a shared reference to relate each workflow stage to feature-level and action-level user stories and interface designs.

The summary and diagrams below are portfolio reconstructions of the mapped workflows.

Compliance workflowSimplified portfolio reconstruction of role ownership and handoffs.

Secretariat creates, assigns and publishes. Respondent submits evidence. Reviewer reviews, with an amendment branch. Secretariat checks completeness and sends to Final Approver. Final Approver validates, with a clarification branch, then approves. Auditor assesses responses and System records the audit log and report.

Compliance workflow · full diagram
  1. SecretariatCreate standard and questionnaire
  2. SecretariatAssign respondents and reviewers
  3. SecretariatPublish and notify
  4. RespondentView assigned questions
  5. RespondentSubmit remarks and evidence
  6. ReviewerReview submissions↶ Alternative branchReturn for amendment
  7. SecretariatCheck completeness
  8. SecretariatSend to Final Approver
  9. Final ApproverValidate final submission↶ Alternative branchRequest clarification
  10. Final ApproverApprove
  11. AuditorAssess responses and raise findings
  12. SystemTrack audit log and generate report
Key insight

Question-level ownership connects assignment, evidence, review, approval and audit, so each response remains traceable.

Tap a workflow image to inspect its details.

TPRM workflow — simplified portfolio representation of the mapped roles and handoffs.
ORA workflow — simplified portfolio representation of the mapped roles and handoffs.

03 / Agree the buildable core

Align before detailed implementation.

Figma comments supported questions and clarification, with finalized workflow versions identified for reference. This gave the team a shared basis for structuring requirements and interpreting the screens. I translated the agreed logic into task visibility, evidence context and interaction details.

Three design priorities emerged.

Ownership
Role-aware task queues help each participant understand what needs attention.
Traceability
Supporting materials and comments stay with the relevant record.
Workflow visibility
Record states and review history preserve context through handoffs.
Key Decisions

[ Key Decisions ]

Making the next action
clear across the system.

Three interface decisions followed from the clarified workflows: make assessments easier to find, keep evidence and review context together, and make record history visible. TPRM screens illustrate selected decisions from the wider Compliance, TPRM and ORA engagement.

01 / Assessment discovery

Find relevant assessments and see their status.

The TPRM listing combines search and filters with assessment names, ownership details and workflow status, helping people locate records and understand their current state before opening them.

TPRM assessment listing — search, filters, ownership context and workflow status appear together.

02 / Evidence traceability

Keep the reason behind each decision.

Questions, answers and reviewer remarks stay together so participants can understand a clarification request in context as the record moves between review stages.

TPRM question-detail view — control, answer context and review conversation.

03 / Workflow visibility

Keep history beside the current state.

Audit history connects actions, timestamps and participants to the record, keeping earlier steps understandable when a review changes hands or returns for amendment.

TPRM audit log — recorded actions and contributors remain visible alongside the assessment.
Delivery & Collaboration

[ Delivery & Collaboration ]

Designed ahead.
Available for support.

Design and implementation progressed in parallel within the three-month delivery window. I worked with business analysts, developers and PETRONAS DesignOps to support reviews and staged handoff.

Design and review

I completed UX/UI design across all three modules, aligning workflows and detailed screens with BAs, developers and PETRONAS DesignOps.

Implementation

When I transitioned into standby support, two modules had completed development and the third remained in development.

UAT and release

The wider team subsequently completed UAT and released all three modules to production within the approximately three-month project window.

Designing within an established system.

I applied PETRONAS’ existing Emerald Hue patterns for tables, forms, statuses and review details, working within DesignOps governance. The delivered design end state included Emerald Hue-aligned side navigation across all three modules.

Implementation was phased: TPRM and ORA used side navigation, while Compliance retained the application's existing top navigation for the MVP. Its navigation migration was planned for a later phase, beyond the approximately three-month delivery window. Product management and engineering managed implementation phasing, development effort and delivery risk.

TPRM review summary — structured third-party assessment form.
ORA listing — operational risk assessments and statuses.
TPRM create assessment — guided entry for supplier information.

Available for clarification through delivery.

During standby support, I remained available to clarify the designs as implementation continued.

impact

[ Impact ]

Delivered through to
production.

Compliance, TPRM and ORA reached production through the wider project team’s delivery work. The figures below describe the overall project outcome, not a separately measured usability result.

3 modules
Compliance, TPRM and ORA — new governance modules designed and delivered.
~3 months
Design, implementation, UAT and production completed by the wider team.
100/100
PETRONAS client evaluation of overall project-team delivery.

This evaluation was not a separate usability test or individual UX rating.

reflection

[ Reflection ]

What I took forward.

MCR reinforced that making complex enterprise work understandable sometimes begins by aligning the people building it, before drawing the final interface.

Requirements need a shared interpretation.

A shared workflow model is part of design delivery: it connects requirements to the screens people build.

Make responsibilities visible.

Roles, states and handoffs need to be understandable to both the people using a product and the teams delivering it.

Design for the actual delivery context.

The compressed timeline reinforced the value of building within PETRONAS’ established Emerald Hue system, responding to DesignOps governance, and collaborating closely with delivery teams.