Managing Risk Workflows

You can create custom risk workflows to streamline your risk management lifecycle, drive alignment across teams, and reduce redundant work. Custom workflows help manage your organization's risks and controls by creating various workflow stages and rules to automate your processes, resulting in greater efficiency and improved results.

The OneTrust application has pre-configured workflows to help your organization track all risks and controls. For more information on the default risk workflow, see About Risk Management Workflows.

Legacy vs New Risk Workflows

Important:

The Risk Workflow Enhancements feature is under Public Preview. Please contact OneTrust Support to request early access. Once this feature has been enabled, it cannot be disabled in your tenant.

The risk workflow experience has been enhanced to provide greater flexibility, improved usability, and stronger alignment with broader platform capabilities. While legacy workflows supported core risk lifecycle management, the new workflow model introduces expanded configuration options, more dynamic stage behavior, and additional rule-based automation to help organizations better manage and track risk activities.

Understanding Legacy vs New Risk Workflows

This section outlines the key differences between the legacy and new risk workflows, highlighting updates to stage settings, rules, and available actions. These enhancements are designed to streamline workflows, reduce manual effort, and enable more consistent and scalable risk management processes across your organization.

Workflow Area

Legacy Risk Workflow

New Risk Workflow

Stage settings

The legacy workflow includes the following stage settings:

  • Set required attributes for this stage

  • Set as approval stage

  • Allow exception requests

The new workflow includes the following stage settings:

  • Set required attributes for this stage

  • Set as approval stage - This setting now supports adding both users and user groups as the approver.

  • Allow exception requests

  • Allow comments when moving to another stage - This is a new setting that has been added, previously, it was an optional check box.

  • Require comments to move to another stage - This is a new setting that has been added.

Stage rule actions

The legacy workflow includes the following stage rule actions:

  • Create task - This action set a static deadline for the task due date.

  • Send notification

The new workflow includes the following stage rule actions only the newly named Stage rules tab:

  • Create task - This action can now be marked as required. You can also add the task priority and task collaborators. A static deadline for the task due date is no longer added. Customers leveraging this functionality should edit or update the task date before migration. After the migration, the deadline will be set as null.

  • Send notification

  • Update attribute

  • Launch assessment

Workflow rules

The legacy workflow includes the following workflow rules and actions:

  • Attribute update

    • Action: Advance to stage

    • Action: Change workflow

The new workflow includes the following workflow rules and actions:

  • Attribute update

    • Action: Change stage - This was previously Advance to stage.

    • Action: Change workflow

Workflow closed stage

The legacy workflow does not include a Closed workflow stage.

The new workflow includes a Closed workflow stage. This stage will close the record and disable users from editing details. For more information, see To activate workflows and close risks.

Workflow buttons

The legacy workflow includes the following buttons:

  • Publish

  • Clone

  • Delete

The new workflow includes the following buttons:

  • Activate - This was previously the Publish button.

  • Clone

Workflow list screen

The legacy workflow includes the following options on the Workflow list screen:

  • Edit workflow

  • Publish

  • Clone

  • Delete

The new workflow includes the following options on the Workflow list screen:

  • Edit workflow

  • Set as default

  • Activate - This was previously Publish.

  • Archive

  • Clone

  • A search bar is now available to easily locate workflows.

To create a workflow

  1. On the IT & Security Risk Management menu, select Setup > Workflows.

    The Workflows screen appears.

  2. Click the View button on the Risk Workflows tile.

    The Workflows screen appears.

  3. Click the Create Workflow button.
    The Create New Risk Workflow modal appears.

  4. Enter a name for the workflow.
  5. Click the Create button.

    The Workflow Details screen appears for you to configure the custom workflow.

To add a new stage in the workflow

You can add new stages to workflows in draft status. To add new stages to a published workflow, you must clone the workflow before making changes.

  1. On the IT & Security Risk Management menu, select Setup > Workflows.

    The Workflows screen appears.

  2. Click the View button on the Risk Workflows tile.

    The Workflows screen appears.

  3. Click the name of the workflow you want to configure.
    The Workflow Details screen appears.
    Note:

    The Workflow Details screen also appears when you create a new workflow.

  4. Click the Add icon and complete the required fields.


    Field
    Description
    Stage Title

    Enter a name for the workflow stage.

    Badge Color

    Select a badge color that helps to identify the workflow stage.

    Note:

    Badge colors helps with managing individual stages to assist with reporting on items that are new, in-progress, under review, rejected, completed, or archived.

    Description

    Enter a brief description of the workflow stage.

  5. Click the Add button. Your stage will be added in the sequence of the workflow.

    You can configure the name, badge color, and description of each workflow stage to build a detailed workflow that fits your organization's needs.

    Note:

    If you want to update the status of a stage, click the Badge Color field and assign a new stage color.

    If you want to add more stages and change the sequence, click the Add icon before or after the stage.

    If you want to delete the stage, click the Delete icon on the stage you wish to delete.

To configure workflow stage settings

You can configure workflow settings when adding a new workflow stage or when editing workflow stages after the initial creation. Workflow stage settings can be configured to set approval stages and to confirm attributes before changing stages.

  1. On the Workflow Details screen, navigate to the Stage Details tab of the workflow stage in which you would like to configure settings.


    Setting Name & Description

    Setting Field

    Setting Field Description

    Select required attributes for this stage:

    Once enabled, the selected attributes are required prior to entering the current workflow stage. You must select the attributes that need to be confirmed before advancing the stage. You also have the option to customize the title and guidance that appears on the modal to confirm the attributes.
    Note:

    This setting can be enabled and configured after a workflow has been published. However, this setting is not available on the first stage of a workflow.

    Attributes

    Required

    Select the attributes that will need to be confirmed before advancing to the next stage.

    Title

    Enter the name of the title that will appear on the modal to confirm the attributes.

    If you do not enter a title, the OneTrust platform will generate a generic title.

    Guidance

    Enter custom guidance that will help users when confirming attributes. This text will appear on the modal to confirm the attributes.

    If you do not enter a title, the OneTrust platform will generate a generic guidance.

    Allow comments during this stage

    Once enabled, you can add a comment to the workflow stage before moving to the next stage.

    If disabled, comments are not required before advancing to the next workflow stage.

    Set as approval stage:

    Once enabled, all approvers added will receive an email notification and have limited access to the current workflow stage. Issue Owners are still able to edit the issue record.

    Auto Advance on Approval

    If enabled, the workflow will automatically move to the next stage once all approvers have approved. If the next workflow stage includes required attributes, the workflow will not advance automatically. Users must manually review and confirm the required information before proceeding.

    If disabled, the workflow will not automatically move to the next stage once all approvers have approved.

    Set Approval Requirements

    Select whether one or all approvers must give their approval.

    Approvers

    Required

    Select the active system users or user attributes that must approve the current workflow stage. You can add or remove approvers once a workflow is published.
  2. Configure the workflow stage settings as needed.
  3. Click the Save button.

To edit the name of a workflow

  1. On the IT & Security Risk Management menu, select Setup > Workflows.

    The Workflows screen appears.

  2. Select the type of workflow you would like to configure.
  3. Hover over the row for the workflow you want to edit until the Context Menu icon appears.
  4. Click the Context Menu icon.
  5. On the Context menu, select Edit Workflow.

    The Edit Workflow modal appears.

  6. Rename the workflow.
  7. Click the Save button.

To publish a workflow

You can publish a draft workflow. Once the workflow has been published, you can progress through the workflow by clicking the Advanced button.

  1. On the IT & Security Risk Management menu, select Setup > Workflows.

    The Workflows screen appears.

  2. Select the type of workflow you would like to configure.
  3. Hover over the row for the workflow you want to publish until the Context Menu icon appears.
  4. Click the Context Menu icon.
  5. On the Context menu, select Publish.
    The Publish Workflow modal appears.

  6. Click the Confirm button.

To activate workflows and close risks

Important:

The Mark Stage as Closed feature is under Public Preview. Please contact OneTrust Support to request early access.

The Closed workflow stage allows organizations to define when a risk has reached the end of its lifecycle within a workflow. By configuring a closed stage, you can standardize how risks are completed and ensure consistent handling of finalized records.

This capability provides greater control over workflow outcomes by enabling you to designate a specific stage that represents completion. Once a risk reaches this stage, it is considered finalized within the workflow, helping teams clearly distinguish between active and completed risk activities and supporting more accurate reporting and tracking.

  1. On the IT & Security Risk Management menu, select Setup > Workflows.

    The Workflows screen appears.

  2. Click the View button on the Risk workflows tile.

    The Workflows screen appears.

  3. Open the new risk workflow you would like to activate.
  4. On the Workflow details screen, click the Activate button.
    The Activate workflow modal appears.

    Field
    Description
    Close record

    Enable this setting to close the risk record once it reaches this stage.

    Close stage

    Select the stage at which the risk record will be closed. By default, the record is set to close in the last workflow stage.

    Disable details edit

    Enable this setting to remove the ability to edit the risk record details. The record must be reopened to make edits.

  5. Click the Activate Workflow button to publish the workflow.
    Note:

    You can also publish a new risk workflow by hovering over the Context menu of the workflow on the Workflows list screen.

To set a default workflow

You can set published workflows as the default workflow used.

  1. On the IT & Security Risk Management menu, select Setup > Workflow.

    The Workflows screen appears.

  2. Select the type of workflow you would like to configure.
  3. Hover over the row for the workflow you want to set as default until the Context Menu icon appears.
  4. Click the Context Menu icon.
  5. On the Context menu, select Set as default.
    The Set as default modal appears.

  6. Click the Confirm button.

To clone a workflow

  1. On the IT & Security Risk Management menu, select Setup > Workflow.

    The Workflows screen appears.

  2. Click the View button on the Risk Workflow tile.
  3. Hover over the row for the workflow you want to clone until the Context Menu icon appears.
    Note:

    If you clone the Default Risk Workflow, some items will not be cloned to the new workflow. The following items are not supported when cloning the Default Risk Workflow:

    • the ability to request an exception

    • the ability to grant an exception

    • the ability to submit an exception

    • the ability to sent back

    • optional attributes; i.e. Residual Risk Score

    • comments made in the Monitoring stage

    • notifications configured for the default workflow

  4. Click the Context Menu icon.
  5. On the Context menu, select Clone.
    The Clone The Risk Workflow modal appears.

  6. Enter the new workflow name.
  7. Click the Clone button.

To archive a workflow

You can archive published workflows.

  1. On the IT & Security Risk Management menu, select Setup > Workflow.

    The Workflows screen appears.

  2. Select the type of workflow you would like to configure.
  3. Hover over the row for the workflow you want to archive until the Context Menu icon appears.
  4. Click the Context Menu icon.
  5. On the Context menu, select Archive.
    The Archive Workflow modal appears.

  6. Click the Confirm button.

To delete a workflow

You can delete workflows that are in draft and archived status. An archived custom risk workflow cannot be deleted until all associated risks have been permanently removed from the tenant. When a risk is deleted, it moves to the Risk Recycle Bin, where it can still be restored. Because of this, the associated workflow remains undeletable until the risk is permanently deleted from the recycle bin.

  1. On the IT & Security Risk Management menu, select Setup > Workflow.

    The Workflows screen appears.

  2. Select the type of workflow you would like to configure.
  3. Hover over the row for the workflow you want to delete until the Context Menu icon appears.
  4. Click the Context Menu icon.
  5. On the Context menu, select Delete.
    The Delete Workflow modal appears.

  6. Click the Confirm button.

To unarchive a workflow

You can activate an archived workflow.

  1. On the IT & Security Risk Management menu, select Setup > Workflow.

    The Workflows screen appears.

  2. Select the type of workflow you would like to configure.
  3. Hover over the row for the workflow you want to unarchive until the Context Menu icon appears.
  4. Click the Context Menu icon.
  5. On the Context menu, select Unarchive.
    The Unarchive Workflow modal appears.

  6. Click the Confirm button.

To edit stage details of published workflows

  1. On the IT & Security Risk Management menu, select Setup > Workflow.

    The Workflows screen appears.

  2. Select the type of workflow you would like to edit.
  3. Click the name of the published workflow in which you'd like to edit stage details.

    The Workflow Details screen appears.

  4. Edit the stage details as needed.
    Note:

    You can edit the following Stage Details fields of published workflows:

    • Stage Title

    • Badge Color

    • Description

    • Set as Approval Stage: Auto Advance on Approval, Select Required Approvers, Add / Remove Approvers

  5. Click the Save button.