Managing Risk Automation Rules | OneTrust Documentation

To add an automation rule group

On the IT & Security Risk Management menu, select Setup > Automation Rules.

The Automation Rules screen appears.
Click the Add Rule Group button.

The Add Rule Group modal appears.
Enter a name for your group.
Select the organization that will be responsible for the group.

Note:
Enable the Run Rule Group for Current Organization Only setting if you would like this rule to run only for the organization selected.
Click the Add button.

To add an automation rule

Go to the Automation Rules screen.
Click the name of the group in which you want to create a rule. This screen also appears once you add a new automation group.
Click the Add Rule button.

The Select Rule Type modal appears.
Select the type of rule you want to create.
Click the Continue button.

The Automation Rule Configurations screen appears.
Enter a rule name.
Select a frequency run.

Note:
Automation rules can be configured to run daily, weekly, monthly, or quarterly when the Set Automation Run Frequency setting is enabled. To enable this setting, navigate to Global Settings and select General Settings > Automation Rules.
Complete the remaining fields. For more information, see Rule Configuration References.
Click the Save button.

Rule Configuration References

Conditions

The conditions of a rule determine whether or not the action for the rule will be triggered. If you use more than one condition block, you can select if any or all of the conditions must be met.

Field: Description
Any/All: Select Any if any of the conditions can be met for the automation rule to occur, or select All if all conditions must be met for the automation rule to occur.
Trigger: Select an option for the type of data that is used to define the condition.
Attribute: Select the attribute that will be used to define the condition.
Operator: Select the measurement that will be used to determine if the condition is met.
Value: Select the criteria that must be met in order for the condition to be triggered.

Actions

The actions are what happens when the conditions are met. The actions that can be selected are based on the rule type.

Reopen Risk

Field: Description
Action: Select Reopen Risk.
Workflows: Choose the name of the workflow in which you would like the reopened risk to use.
Change to Stage: Select the workflow stage in the chosen workflow in which you would like the risk to use.
Run stage rule upon advance: Enable this setting to run the stage rule when the workflow is advanced.
Add Action: Click the Add Action button to add more actions to the automation rule.

Send Risk Email

Important:

If you configure an automation rule to send risk emails and include an attachment in the email body, keep in mind that external email providers can block images. OneTrust cannot control visibility of the images on the email notifications triggered from automation rules, this is fully dependent on external email providers.

Field

Description

Action

Select Send Risk Email.

Recipient(s)

Select the user, enter the user email, or select the user type attribute of the recipient of the notification email.

Subject

Enter the subject of the email. An email subject is pre-filled for you. You can click the Plus icon to add system and custom risk attributes as dynamic variables.

Body

Enter a message that will appear as the body of your email. You can click the Plus icon to add the following system risk attributes as dynamic variables:

Risk ID
Risk Name
Risk Description
Risk Workflow
Risk Workflow Stage

Add Action

Click the Add Action button to add more actions to the automation rule.

To edit an automation rule

Go to the Automation Rules screen.
Click the name of the group in which you want to edit a rule.

The Rule Group screen appears.
Click the Context Menu icon button of the rule you want to edit.
On the Context menu, select Edit.
Update the fields, as needed. For more information, see Rule Configuration References.
Click the Save button.

To delete an automation rule

Note:

Automation rules are not deleted when a user is deleted. If a user is deleted, the rule will be re-assigned to the user's manager or default approver.

Go to the Automation Rules screen.
Click the name of the group in which you want to delete a rule.

The Rule Group screen appears.
Click the Context Menu icon button of the rule you want to delete.
On the Context menu, select Delete.

The Delete Rule modal appears.
Click the Confirm button.

Risk Automation Rules FAQ

What solutions do I need in order to create risk automation rule types?

You must have IT Risk Management (Enterprise or Standard SKU), Tech Risk & Compliance, or Third-Party Risk Management (Enterprise or Standard SKU) to access risk automation rules.

Does my rule run against all organizations in my organizational hierarchy, based on the organization set on the rule?

Yes. You have a parameter to set if you want the rule against inventory records in specifically the organization set on the rule or on all of the organizations that roll up to the organization set on the rule itself.

What records are evaluated when risk automation rules execute?

Only records with an Active status will be considered when automation rules are executed.

Can I set up conditions to look at text type attributes?

No. Currently, only date, single select, and multi-select attribute types are supported in the condition blocks.

Are there any attributes that are not supported for automation rules?

Currently, the text type attributes are not supported for automation rules. However, the date, single select, multi-select, user, and country type attributes are supported.

Can I select multiple values for my single select and multi-select attributes for a single condition block?

No. However, if you have a condition you are trying to create to view multiple values for a single attribute, simply create multiple condition blocks with the same attribute and use the 'Or' operator between these values to construct your rule.

Can users in lower organizations see the rules I create?

No, they cannot see the rules you create. If a user in a lower organization has access to the automation rules user interface in a lower organization, the user can only see the rule group name in a non-edit state. They are unable to go into the rule group detail to view the rule list or make changes to rules in higher organizations.

What does Days Before and Days After mean?

For custom date type attributes, setting a condition of days before means the system will evaluate if your date values are in the future. Here are some examples of what to expect. For more information, see Rule Examples for Custom Date Attributes.

Today is May 1st.
Less than or equal to 30 days before today would start a trigger for date values in the range from today to June 1st. This is because June 1st and all dates before are within 30 days away from today.
Greater than or equal to 30 days before today would start a trigger for date values in the range from June 2nd and beyond. This is because June 2nd is greater than 30 days away from today.
Greater than or equal to 30 days after would trigger for date values in the range from April 1st and all dates prior. This is because April 1st and all dates before are greater than 30 days prior to today.

Rule Examples for Date Attributes


Use Case	Rule Operator	Days	Before/After
Send me a notification one month in advance to my date attribute.	Equal to	30 Days	Before
Send me a reminder a week in advance and every day until the date occurs.	Less than or Equal to	7 Days	Before
Send me a notification after a month has passed and each day after.	Greater than or Equal to	30 Days	After
Send me a follow-up notification a week after my date.	Equal to	7 Days	After
Send me a notification after a month in advance and continue sending follow-up notifications for a week.	Less than or Equal to AND Greater than or Equal to	30 Days 23 Days	Before Before