Reviewing and Remediating Risks

Once an assessment has been submitted by a respondent, the approver can identify potential risks on the assessment. The approver can then send the Risk Owner a recommendation on how to rectify and minimize the risk. For more information, see Flagging Risks on an Assessment.

If the approver decides to treat the risk, they will create a treatment plan that includes completing specific tasks, assigning a risk owner, and adding controls to mitigate the risk. The approver can add additional owners as needed and the owners will receive a notification.

Note:

Invited Users have the ability to reassign risk owners when editing risks in the under-review stage of the assessment workflow when the Allow Invited Users to Re-assign Risk Owner setting is enabled in Global Settings.

To review an assessment risk

  1. On the PIA & DPIA Automation menu, select Assessments > Active. The Assessments screen appears.

  2. Click on the name of the assessment for which you want to view assessment risks. The assessment appears.
    Note:

    You cannot view assessment risk for assessments in the Not Started status.

  3. Click the Risk Flag icon. The Flagged Risks pane appears. 


  4. Select the risk you would like to review and edit the fields as needed.
  5. Click the Save button to save any changes made.

To submit a treatment plan

After reviewing the risk, the risk owner can submit the risk treatment plan. The treatment status is updated using the system workflow and the risk now becomes view only for the risk owner. At this point, the system deadline and reminder field will begin evaluating. The deadline will be for the risk approver to approve the treatment plan or send it back.

  1. Open a risk with a proposed recommendation in the Flagged Risks pane.
  2. Click the Submit button. The Submit Treatment Plan modal appears.


    Note:

    This button only appears if the approver has moved the risk to the Treatment stage.

  3. Enter a comment before submitting the treatment for review.
  4. Click the Submit button. The assessment approver will be notified of the change in the risk status.

To request an exception

After reviewing the risk, the risk owner can request an exception. This action closes the risk in the chosen state and it will not be mitigated further. The risk approver can grant the exception or send the risk back to the risk owner. Sending the plan back to the risk owner will reset the treatment status to In Progress.

  1. Open a risk with a proposed recommendation in the Flagged Risks pane.
  2. Click the Request Exception button. The Request Exception modal appears.


    Note:

    This button only appears if the approver has moved the risk to the Treatment stage.

  3. Enter a comment before submitting the exception that explains the reason for the exception.
  4. Click the Submit button. The assessment approver will be notified of the change in the risk status.

To approve a treatment plan or grant an exception

Note:

Only the risk approver can approve a treatment plan or grant an exception.

  1. Open a risk in the Flagged Risks pane. 
  2. Click either the Approve or Grant Exception button. This notifies the Risk Owner that the remediation or exception has been approved.
  3. Complete the required fields in the modal and click the Confirm button.




To send back a risk

Note:

Only the risk approver can send a risk back for further review.

  1. Open a risk in the Flagged Risks pane. 
  2. Click the Send Back button. This notifies the Risk Owner that the treatment plan or exception has been declined and requires further review.

To add controls to a risk

  1. Open a risk in the Flagged Risks pane.
    Note:

    Controls cannot be added to risks with a status of Reduced.

  2. Select the Controls tab and click the Add Control button. The Add Controls modal appears.


  3. Select the framework from which the controls you want to add originate.
  4. Select the check boxes for the control(s) you want to add.
  5. Click the Add button.
    Note:

    Controls added to a risk in an inventory assessment will update the associated inventory record with the added control once the assessment is approved.

To change the status of a control on a risk

  1. Open a risk with an associated control in the Flagged Risks pane.
  2. Select the Controls tab.
  3. Click the checkbox of the control(s) in which you would like to change statuses.
  4. Click the Update Control Status icon. The Update Status modal appears.


  5. Select the status you want to update the control to from the Control Status field.
  6. Click the Confirm button.