About Custom Risk Workflows and Routing Rules

Overview

You can create custom risk management workflows to track risks from the time they are identified to the time they are closed. In this article, OneTrust provides expert advice on configuring a two-risk workflow process to differentiate between high and low risks.

Best Practices

An organization can follow two different levels of mitigation and approval on their risks depending on the level of risk being flagged.

Low Risk Workflow

The risks identified with an inherent risk level of low and fall below an organizations threshold can use the custom Low Risk Workflow. The risk owner can simply review and close these risks with no approval.

To create a Low Risk Workflow, follow the steps to create a new workflow in the Adding and Editing Risk Workflow article. Configure the workflow so that you have two stages with no automation rules configured. The two stage names are Open and Monitoring.



High Risk Workflow

The risks identified with an inherent risk level of medium or higher may require a greater level of risk remediation and approval to mitigate and close. Therefore, a custom High Risk Workflow is needed. This workflow is a more detailed risk workflow that includes stages for risk approval and Chief Information Security Officer CISO approval (if required).

To create a High Risk Workflow, follow the steps in the Adding and Editing Risk Workflows and Creating Advanced Risk Management Workflows articles. Configure the workflow so that you have five stages:

  1. Open

  2. Treatment

  3. Risk Manager Approval

  4. CISO Approval (if needed)

  5. Monitoring

The Risk Manager Approval stage should be set as an approval stage with the ALL approvers option selected. The CISO Approval stage should be set as an approval stage with system user approval and tied to the custom risk field for CISO.