Converting Risks to Issues

Convert risks to issues to declutter your Risk Register and manage risks more effectively. In this two step process, you'll map the risks to issues workflows and attributes. You can undo conversions by restoring issues to risks on the new Converted risks screen.

An issue is a deviation, deficiency, or event that introduces risk to systems, data, operations, or compliance—requiring documentation, remediation, and potential escalation. An issue differs from a risk because it is an event that has already occurred whereas a risk is the potential for a future event. An issue may arise because a risk materialized (e.g., the encryption risk became an actual audit finding). Issues can be related to or factored into your residual risk score to have a more complete understanding of your risk posture. Identifying an issue may trigger a review of existing risks or lead to the creation of a new risk.

Considerations for identifying risks that are issues

Every organization has a different criteria for what they define as a risk. The records that fall outside of your organizations definition of risk can be converted to an issue. If you want to perform a risk to issues conversion in bulk, you will need to filter the Risk Register. Here are a few examples of how this can be achieved:

  • Consider which attributes make up your risk definition. You can filter the Risk Register to only display records that do not meet that criteria.

  • Create a custom attribute that clearly identifies risks and issues within your organization. You can then filter the Risk Register to only display the issues.

  • If a low risk score is a criteria for a risk that may be an issue, you can filter the Risk Register by risks with a low score.

Before you Begin

When converting risks to issues, you are required to select a workflow or routing rule and map attributes. To do this, you must have issue workflows and attributes configured before starting the conversion process.

Step 1: Configure Custom Workflows or Workflow Routing Rules

If you do not have custom issues workflows configured, you must map to the Default Issues Workflow. For more information, see Managing Issue Workflows.

Instead of manually choosing a workflow, you can use routing rules to select an issue workflow. If you would like the newly converted issue to be assigned to an issue workflow based on routing rules, you must have routing rules configured. For more information, see Configuring Issue Workflow Routing Rules.

Step 2: Configure Custom Attributes

During the conversion process, you must map risk attributes to issue attributes. If there are certain details you would like to capture in the issue record, you should create a custom issue attribute that the risk can map to. For more information, see Adding, Editing, and Deactivating Issue Attributes.

To convert risks to issues

Important:

You must have the Convert risks and Convert risks to issues permissions to be able to convert risks to issues. These permissions have been pre-seeded into the Site admin role.

  1. On the IT & Security Risk Management or Risks menu, select Risk Register.

    The Risk Register screen appears.

  2. Select the checkbox for the risk(s) you would like to convert to issue(s), and then click the Conver to issues button.
    Note:

    You can also convert an individual risk record by clicking the Context Menu icon in the Risk Details screen header and selecting Convert risk to issue.



  3. On the Select workflow screen, select how you would like to assign the issues to workflows and stages.


    Note:

    Option 1: Enable the Use my configured issue routing rules setting to move the newly created issue to a workflow and stage. If routing rules do not apply or are not configured, use option 2.

    Option 2: Manually choose the Issue workflow and Issue workflow stage in which the newly created issue will be moved. This option is only available if the Use pre-configured issue routing rules setting is disabled. If used, all selected risks will use the same issue workflow and stage.

  4. Click the Next button.
    Tip:

    The system attributes below will be pre-mapped for you. You have the ability to edit these pre-mapped attributes, if needed.

    • Risk Name

    • Risk Owner

    • Risk Approver

    • Deadline

    • Description

    The system attributes below have been pre-mapped for you and cannot be edited:

    • Organization

    • ID

    • Source

    • Source Type

    • Created By (the user who created the risk)

    • Created Date (the date the risk was created)

    The Map attributes screen appears.

  5. Map existing system and custom risk attributes to the new issue attributes. Any attributes not mapped will not be included as issue attributes. Click the Reset mapping button at anytime to reset the attributes.
    Important:

    • The Issue attributes column lists all issue attributes, ordered by required attributes first, then alphabetically.

    • When mapping to the Risk attributes column, you must select a compatible attribute of the same type. First identify the issue attribute you want to map, then choose the corresponding risk attribute to complete the mapping.

    • Formula and score-type attributes are not supported in the mapping template. These attributes will not be migrated during the conversion process and shouldn't be included.

    • Required issue attributes must be mapped. Required attributes are marked with an asterisk (*) symbol.

    • If a matching issue attribute does not exist, you can create a custom issue attribute and include it in the mapping.

    • Single select and multiselect attributes will display the default vales at the bottom of the risk attribute drop-down list.



  6. Click the Next button.
    The Confirmation screen appears.

  7. Review the risk data that will and will not be converted to an issue. If data appears incorrect, click the Previous button to return to an earlier screen to make updates.
  8. Click the Convert records button.


    The Converting records modal appears.

  9. Click the View converted records button to navigate to the Converted risks screen. You will receive a notification in the header once the conversion is complete.


    Note:

    Both successful, failed, and in-progress conversions will appear on the Converted risks list screen.

    • The Migration status field will display SUCCESS if the risk was converted successfully. In this case, the risk will no longer appear in the Risk Register.

    • The Migration status field will display FAILED if the risk was not converted. In this case, you should download the issue conversion report, fix the errors listed, and retry the conversion. Risks that failed the conversion will no longer be visible on the Risk register screen.

To download the issue conversion export

Once the risk to issue conversion is complete, a notification will appear in the Global Header.

  1. On the Notifications popover, click the Issue Conversion Export to open the report in Excel.


  2. Review the report to identify conversion details and errors that may have occurred. Errors will be added to the Error Reference column.
    Tip:

    You can use the information in the Error Reference column to fix the error, and retry the risk to issues conversion.

To restore converted risks

You can restore the risks that have been converted into issues on the Converted risks screen. Restoring risks provides much needed flexibility since risks and issues can evolve rapidly.

  1. On the IT & Security Risk Management or Risks menu, select Risk Register.

    The Risk Register screen appears.

  2. Click the Context Menu icon select Converted Risks.
    The Converted risks screen appears.

  3. Select the checkbox for the converted risk(s) you would like to restore as a risk(s).
    Note:

    You can also hover over the row for a converted risk you would like to restore, click the Context Menu icon, and select Restore risk.

  4. Click the Restore risk button to restore the converted risk(s).
    The risk record will then appear on the Risk Register.

To retry conversions

You can retry conversions that failed to convert successfully on the Converted risks screen. Risks that failed the conversion will no longer be visible on the Risk register screen. Retrying conversions allows you to avoid the need to re-enter or duplicate data.

Tip:

You can use the information in the Error Reference column to fix errors before retrying conversions.

  1. On the IT & Security Risk Management or Risks menu, select Risk Register.

    The Risk Register screen appears.

  2. Click the Context Menu icon select Converted Risks.
    The Converted risks screen appears.

  3. Select the checkbox for the record(s) you would like to retry.
  4. Click the Retry conversion button to retry the conversion. The migration status of the conversions will appear on the Converted risks list screen.

Understanding Error Messages

The table below lists common error messages that may appear when converting risks to issues. In most cases, these errors will prevent the conversion from completing successfully.

Error Message

Description

SourceType {Source Type Name} not supported e.g., “SourceType Projects not supported”

Issues do not support the object (Source Type) this risk was created from. The risk must be manually converted to an issue.

ERROR_ATTRIBUTE_EXTENSION_DISABLE_ATTRIBUTE_FOUND

A disabled issue attribute has been included in the attribute mapping.

No Mappings Available to proceed

The issue and risk attribute values do not match. The issue attribute getting mapped must contain the same values as the risk attribute you are mapping from.

Invalid Risk to proceed, Risk information cannot be empty

The risk to issue conversion was interrupted while in-progress. Retry the conversion.

Failed to bulk reassign task parent entities with error: {exception message} HTTP STATUS -500

A system error occurred during the bulk reassignment of task parent entities. Retry the conversion.

Failed to bulk reassign comment references with error message: {exception message} HTTP STATUS -500

A system failure occurred when attempting to reassign comment references in bulk. Retry the conversion.

Failed to fetch enabled entity types

The system could not retrieve the list of enabled entity types. Retry the conversion.

Failed to bulk attach documents HTTP STATUS -500

A system error occurred when attaching documents in bulk. Retry the conversion.

Failed to bulk create entity links {exception message} HTTP STATUS -500

A system error occurred during creation while attempting to copy over relationships. Retry the conversion.

Frequently Asked Questions

What risk data is transferred to the issue?

Risk data will be transferred to the corresponding tabs on the issue record. The data that will be transferred includes:

Note:

The Summary, History, and Activity tabs do not transfer data from risks to issues.

  • Activity - will be included on the Activity tab of an issue record. It will only capture events since the record was converted to an issue. You can view the risk activity by clicking the View risk activity button that at appears in the activity history.

  • Assessments - will be linked on the Source Attribute of an issue record

  • Attachments - will be included on the Documents tab of an issue record

  • Attributes - will be included on the Details tab of an issue record

  • Comments

  • Controls - will be included on the Related tab of an issue record. If a control is implemented directly on a risk and that risk is later converted into an issue, the control’s source reference on the issue will no longer be linked/related because the original risk no longer exists. While controls can be implemented on risks and mapped to issues, control implementations themselves cannot be converted to use an issue as the source.

  • Related Objects (inventories, controls, policies, etc.)

  • Tasks

How do I know if I have had a successful conversion?

View the reports available in the Notifications popover. The Issue Conversion Export will display conversion details and errors. The Issue Management notification will take you to the Converted risks screen where you can view newly converted issues. You can also view the Converted risks screen when you submit the conversion.

How do I know if a risk failed to convert to an issue?

Risks that failed the conversion will no longer be visible on the Risk register screen. To view these risks, navigate to the Converted risks screen. These records will display a Failed status.

When a risk fails to convert to an issue, OneTrust recommends triaging the issue, updating the mapping (if required), and retrying the conversion. You can also restore the risk so that it returns to the Risk register.

Who is notified when a risk is converted to an issue?

The risk owner and approver are notified when a risk is converted to an issue.

The Risk to issue conversion summary email template is used to notify risk owners and approvers when a risk is converted to an issue.

You can find the Risk to issue conversion summary email template and description template under Global Settings > Email branding & templates.

Is there a way to easily identify risks that have been converted into issues?

Yes. Navigate to the Converted risks screen by clicking the Context Menu icon on the Risk register screen to view converted issues.