Flagging Risks on an Assessment

You can flag risks and propose remediation steps on a completed assessment.

To flag risks on an assessment

  1. On the PIA & DPIA Automation menu, select Assessments > Active. The Assessments screen appears.

  2. Click on the name of an assessment with the status Under Review.
  3. Click the Review button to open the assessment and flag risks.
  4. Click the Flag Risk icon next to a question for which you would like to flag a risk. The Flag Risk modal appears.

  5. Complete the fields. For more information, see Flag Risk Screen Reference.
  6. Click the Add button to add the risk to the assessment.

    Click the Save and Add Controls button to add the flagged risk to the assessment and add related controls to the risk. You can add a control from the Controls Library or you can create a new custom control.

Flag Risk Screen Reference



Field
Description
Select a Risk From the LibraryCreate New Risk

Select an existing risk from the library or create a new risk.

Inherent Risk Level

Select the level of risk you want to flag.

Note:

If you have risk heatmaps enabled, you will be able to choose the level of risk based on the heatmap set up for your organization.

If you do not use risk heatmaps, the available options will be low, medium, high, and very high.

Risk Name

Enter the name of the risk.

Threat

Select the threat(s) the risk presents.

Vulnerability

Select the vulnerability category the risk falls into.

Category

Select the associated category the risk falls under.

Risk Owner(s)

Select the name(s) responsible for remedying the risk.

Risk Approver(s)

Select the name(s) responsible for approving the risk.

Deadline

Select a deadline by which the risk must be resolved.

Reminder

Enter the number of days before the deadline which the respondent(s) should be reminded to complete the risk assessment.

Description

Enter a description of the risk and why it has been flagged.

Treatment Plan

Enter a plan to control, mitigate, and/or resolve the risk.

To view risks flagged on an assessment

  1. Open an assessment that has a status of Under Review or Complete. 
  2. In the header for the assessment, click the Risk Flag icon . The Risks pane appears.


  3. In the Risks pull-down menu, select the type of risks you want to view.

    Select All Risks to view all risks associated with the assessment.

    Select Assigned to Me to view all risks assigned to you.

    Select Open Risks to view risks which have been flagged, but do not have a treatment plan.

    Select Pending Treatment to view risks in the Treatment workflow stage without a treatment plan.

    Select Pending Approval to view risks which have a treatment plan but are pending approval.

  4. Click the Close icon to close the Risks pane.

To edit a flagged risk

  1. Open an assessment that has a status of Under Review or Complete.
  2. In the header for the assessment, click the Risk Flag icon. The Risks pane appears.

  3. Select a risk to view the details of the risk.
  4. Click the Edit icon next to the field you want to edit.
  5. Revise the fields as needed.
  6. Click the Save button.

To delete or unlink a flagged risk

  1. Open an assessment that has a status of Under Review or Complete. 
  2. In the header for the assessment, click the Risk Flag icon. The Risks pane appears.

  3. Select the risk you want to delete or unlink.
    Note:

    Deleting the risk will permanently remove the risk from all related assessments and inventories. Unlinking a risk completely removes the risk association from the assessment. In some cases, this could make the risk a standalone risk and lost in the risk registrar

  4. In the header of the risk pane, select the Context Menu icon.


  5. On the Context menu, select Delete or Unlink. The related modal appears.

  6. Click the Delete or Unlink button.

To advance risks to the treatment stage

In order to notify the risk owner(s) that they have been assigned a risk, the risk approver must advance the risk to the Treatment stage. In the Treatment stage, the risk is actively mitigated by the risk owner. During this time, tasks are completed, control statuses are updated, and the treatment plan is executed.

  1. Open an assessment that has a status of Under Review or Complete. 
  2. In the header for the assessment, click the Risk Flag icon. The Risks pane appears.

  3. Select the risk in which you would like to advance the risk to the Treatment stage.
  4. Click the Treatment stage in the risk workflow. The Advance Stage modal appears.


    Field
    Description
    Risk Owner

    Select the risk owner(s) responsible for mitigating the risk.

    Treatment Plan

    Enter the treatment plan details. This may include completing specific tasks, assigning a risk owner, and adding controls to mitigate the risk.

  5. Complete the required fields.
  6. Click the Save & Advance button to move the risk to the Treatment stage. To continue this process, see Managing Risks in an Assessment.