Risk, Controls & Evidence Settings

You can manage the Risk, Controls & Evidence Settings on the Global Settings menu. Risks, Controls, and Evidence settings control risk assignment and scoring, control implementation options, and evidence-collection notifications and calendar configuration.

To configure General Risk Settings

General Risk Settings allow users to determine invited user assignment privileges.

  1. Click the gear icon in the upper right-hand corner to access Global Settings.
  2. On the Global Settings menu, select Risks > General. The General screen appears.

  3. Customize the General Risks Settings, as necessary.


    Product

    Field

    Description

    Risks

    Allow Invited Users to Re-assign Risk Owner

    Enabling this setting will allow invited users to re-assign risk owners in the Risks menu. Keep this setting disabled to prevent unauthorized users from becoming owners of risks.

    Enable Users List for Invited Users

    Enabling this setting will allow invited users who are Risk Owners to view a list of users when re-assigning work.

    Enable Automated Control Inheritance

    Enabling this setting will allow users to automatically create or link a control implementation to all related inventory items when adding controls to a risk that is related to multiple inventories.

    Managing Organization Assignment for Risks

    (Ability to Change Risk Organization)

    Enabling this setting will allow users to select a managing organization for risks created within an inventory, assessment, or object. Disabling this setting will automatically assigned risks to the managing organization of the object in which the risk is created.

    Note:

    If enabled, the managing organization of risks linked to the source entity will not automatically update when the source entity's managing organization changes.

    Notify Risk Owners When They're Added to Risks

    Enabling this setting allows users to automatically send Risk Owners an email notification when they are added to a risk during any stage of the default workflow.

    Controls

    Enable Control Implementations to be Edited When in Monitoring Stage

    Enabling this setting will allow users with control edit permissions to edit control implementation attributes when the control is in the Monitoring stage.

    Evidences

    Select start month of collection calendar

    Enabling this setting will allow users with the Edit Evidence Task Interval Start Month permission to define the starting month for collection intervals across an organization. This allows you to align your collection interval start date with your fiscal and audit calendars instead of the calendar year.

    Note:

    If this setting is disabled, the system will default to maintain the current system behavior.
  4. Click the Save button.

To configure Risk Scoring Settings

Risk Scoring Settings allow users to configure how risks are scored and the divisions between levels based on the scores.

  1. Click the gear icon in the upper right-hand corner to access Global Settings.
  2. On the Global Settings menu, select Risks > Risk scoring. The Risk scoring screen appears.
    Note:

    You can also access Risk Scoring Settings by clicking Settings on the IT & Security Risk Management menu.

  3. Customize the Risk Scoring Settings, as necessary.


    Tab

    Field

    Description

    Individual

    Restore to Default

    Click the Restore to Default button to return to the application's default scoring methodology.

    Scoring Methodology

    Set the default individual risk scoring methodology, The available options are Matrix or Standard.

    Heatmap Matrix

    Customize the risk heatmap matrix to reflect the scoring methodology used in your organization. The following aspects of the heatmap can be configured:

    • Number of columns

    • Number of rows

    • Name of each column

    • Name of each row

    • Value in each cell

    Hover over the element you want to configure until the Edit icon button appears.

    Risk Level Ranges

    Set the range for each level of risk by adjusting the Risk Level Ranges slider. For more information on configuring the individual risk heatmap, see Setting Up Risk Scoring.

    Assessment

    Asset

    Processing Activity

    Entity

    Engagement

    Default Aggregation Methodology

    Set the aggregation methodology for assessments, assets, processing activities, vendors, entities, and engagement in each of their respective tabs. The aggregation method determines how the overall risk level for an object is set.

    • Highest: sets the overall risk level for the object as the highest value flagged risk on the object.

    • Average: represents a sum of the values of the risks flagged, divided by the number of risks. You can configure the ranges for each level of risk based on the average score.

    • Risk Count: uses a custom formula based on the count of risks at each level to determine the overall risk level for the object. You can configure the formula to specify the number of risks per level that must be found to set an overall risk level

    • Sum: represents a sum of the values of the risks flagged. You can configure the ranges for each level of risk based on the sum of the scores.
  4. Click the Save button.

To configure Evidence Notifications Settings

Evidence Notification settings allow users to send email reminders based on the collection interval type and deadline to collect pending evidence.

  1. Click the gear icon in the upper right-hand corner to access Global Settings.
  2. On the Global Settings menu, select Risks > Evidence notifications. The Evidence notifications screen appears.

  3. Customize the Evidence Notifications Settings, as necessary.


    Collection Interval

    Description

    Weekly

    Configure up to three reminders that are sent to assignees to collect pending evidence. Click the checkbox next to each reminder you'd like to configure. The weekly reminder options include:

    • Email a reminder between 1-6 days before due date. You must enter a value in the Number of Days field between 1-6.

    • Send an email reminder on the due date.

    • After the due date, email reminders until evidence is collected can be sent daily, weekly, or monthly. The email reminders will begin sending the following business day after the due date.

    Biweekly

    Configure up to three reminders that are sent to assignees to collect pending evidence. Click the checkbox next to each reminder you'd like to configure. The biweekly reminder options include:

    • Email a reminder between 1-13 days before due date. You must enter a value in the Number of Days field between 1-13.

    • Send an email reminder on the due date.

    • After the due date, email reminders until evidence is collected can be sent daily, weekly, or monthly. The email reminders will begin sending the following business day after the due date.

    Monthly

    Configure up to three reminders that are sent to assignees to collect pending evidence. Click the checkbox next to each reminder you'd like to configure. The monthly reminder options include:

    • Email a reminder between 1-30 days before due date. You must enter a value in the Number of Days field between 1-30.

    • Send an email reminder on the due date.

    • After the due date, email reminders until evidence is collected can be sent daily, weekly, or monthly. The email reminders will begin sending the following business day after the due date.

    Quarterly

    Configure up to three reminders that are sent to assignees to collect pending evidence. Click the checkbox next to each reminder you'd like to configure. The quarterly reminder options include:

    • Email a reminder between 1-90 days before due date. You must enter a value in the Number of Days field between 1-90.

    • Send an email reminder on the due date.

    • After the due date, email reminders until evidence is collected can be sent daily, weekly, or monthly. The email reminders will begin sending the following business day after the due date.

    Biannually

    Configure up to three reminders that are sent to assignees to collect pending evidence. Click the checkbox next to each reminder you'd like to configure. The biannual reminder options include:

    • Email a reminder between 1-182 days before due date. You must enter a value in the Number of Days field between 1-182.

    • Send an email reminder on the due date.

    • After the due date, email reminders until evidence is collected can be sent daily, weekly, or monthly. The email reminders will begin sending the following business day after the due date.

    Yearly

    Configure up to three reminders that are sent to assignees to collect pending evidence. Click the checkbox next to each reminder you'd like to configure. The yearly reminder options include:

    • Email a reminder between 1-364 days before due date. You must enter a value in the Number of Days field between 1-364.

    • Send an email reminder on the due date.

    • After the due date, email reminders until evidence is collected can be sent daily, weekly, or monthly. The email reminders will begin sending the following business day after the due date.
  4. Click the Save settings button.