Configuring a Risk Score Matrix

Note:

Configuring the risk score matrix is part of the risk scoring upgrade. Beginning in the OneTrust 202307.1.0 release, qualified customer accounts can request the risk score upgrade. See Risk Scoring Upgrade Guide for qualified account requirements.

The risk scoring upgrades are currently under preview. If your organization would like to enable access to any of the preview features listed below, please contact OneTrust Support to submit the request.

You can edit the level color, score ranges, and levels to customize your risk score matrix in the Attribute Manager. Any configurations you create here will be consistent across all of your owned modules. For example, you cannot have a different methodology for IT & Security Risk Management and Third-Party Risk Management.

For more information on risk scoring, see Risk Scoring Upgrade Guide.

To change the attribute to a matrix score type

The following score type attributes can be used to configure a matrix on the new Matrix tab.

  • Inherent Risk Score

  • Residual Risk Score

  • Target Risk Score

The attribute must be changed to a matrix score type using the steps below before you can configure the risk score matrix.

  1. On the IT & Security Risk Management menu, select Setup > Attribute Manager.

    The Attribute Manager screen appears.

  2. Click the View button on the Risk Attributes tile.


    The Attribute Manager screen appears.

  3. Open a score type attribute.
    The Attribute Details screen appears.
    Note:

    The score type attributes you can open are Inherent Risk Score, Residual Risk Score, and Target Risk Score.

  4. Click the Edit Details button.

    The Edit Attribute Details modal appears.

  5. Complete the fields. For more information, see Edit Attribute Details Modal Reference.
  6. Click the Save button.

Edit Attribute Details Modal Reference



Field
Description
Score Type

Select Matrix.

Rescore Existing Risks

Enable this setting to rescore existing risks with the new formula.

Note:

If this setting is disabled, only net new risks will be calculated.

The risk rescore will impact all risk fields. This action is irreversible.

Default Formula For Matrix Scoring

Select the default formula used to calculate your risk scores. The options are Sum or Multiply.

Edit Matrix

Click the Edit button to edit your score levels and automatically update the matrix and axis. The Score Levels modal will appear.



On the Score Levels modal, you can edit the level color, score, and level name. You can also add or remove levels. Click the Continue button to move forward.

Note:

The Level Name can not be edited after the attribute is created.

You can configure the aggregation method for inventories in Global Settings > Risk Scoring. This determines how individual risk points form a comprehensive risk score.

To edit the matrix in Attribute Details

Note:

The risk rescore will impact all risk fields. This action is irreversible.

Changing this matrix score type to a formula score type will remove all of your previous configurations.

  1. On the IT & Security Risk Management menu, select Setup > Attribute Manager.

    The Attribute Manager screen appears.

  2. Click the View button on the Risk Attributes tile.

    The Attribute Manager screen appears.

  3. Open the attribute you assigned as a matrix score type.

    The Attribute Details screen appears.

  4. Select the Matrix tab.
  5. Click the Edit Matrix button.
    Note:

    You can click the Edit Details button to open the Edit Attribute Details modal and change the score type.

  6. Edit your risk score matrix.


    Field
    Description
    Default Risk Scoring Formula

    Select the default formula used to calculate your risk scores. The options are Sum or Multiply.

    Preview Matrix

    View your risk matrix that has been updated based on the select default risk scoring formula. Editing your risk score details will automatically update the matrix and axis.

    The x and y axis are based on the probability and impact fields for that risk field. For example, the inherent probability and inherent impact > inherent risk / the residual probability and residual impact > residual risk.

    Tip:

    The probability and impact are now single select attributes that can be customized.

    You can add options to the probability and impact attribute types and activate or deactivate attribute options to update the matrix. See Adding, Editing, and Deactivating Attributes and Adding, Editing, and Deactivating Options for an Attribute.

    Score Levels

    View your score levels that have been updated based on your risk level scores and colors. Editing your risk score details will automatically update the score levels.

    Level Color

    Click the color box to select a color for each field. You can also enter a hex code directly into the text box to apply the color to the score level. Editing your level color will automatically update the matrix and score levels.

    Score

    Enter the score you would like to apply to each level name. Editing your risk score will automatically update the matrix and score levels.

    Level Name

    View the name of the level in which you can edit the level color, change the score, or add/ remove the level entirely.

    Note:

    You are unable to edit the level name for system or custom attributes.

    Remove / Add Icons

    Click the Minus icon to remove the level from the matrix.

    Click the Plus icon to add a new level to the matrix. This option will require you to enter a new level name.

  7. Click the Save button.
    The Rescore modal appears.

  8. Click the Rescore & Save button to rescore existing risks and related objects with this new formula/ level configuration.

    Click the Don't Rescore & Save button to not rescore. In this case, only net new risks will be scored using this new formula / level.