Managing Risks in an Assessment

Once an assessment has been submitted by a respondent, the approver can identify potential risks on the assessment. The approver can then send the Risk Owner a recommendation on how to rectify and minimize the risk. For more information, see Flagging Risks on an Assessment.

Invited Users have the ability to reassign risk owners when editing risks in the under-review stage of the assessment workflow when the Allow Invited Users to Re-assign Risk Owner setting is enabled in Global Settings. If the approver decides to treat the risk, they will create a treatment plan that includes completing specific tasks, assigning a risk owner, and adding controls to mitigate the risk. The approver can add additional owners as needed and the owners will receive a notification.

Important:

Individual risk scores may differ from the aggregate risk score of an assessment.

This is because an individual risk may appear as high, but in an assessment with multiple risks created, the aggregate score of those risks and the methodology used (sum, average, etc.) can result in different scores. This results in the assessment aggregate risk score showing as one level while the individual risk shows another score. This is expected behavior.

For example, an assessment has three individual risks with a score of low, medium, and high. However, the residual risk score of the assessment is high due to the combined risk scores and scoring methodology.

Viewing Assessments within IT Risk Management

There are multiple Assessments screens in OneTrust. Which assessments appear depends on the template type used and the OneTrust products/subscriptions your organization has access to. As a result, not all assessments appear within IT Risk Management. For example, assessments based on primary records (assets, entities, vendors) will not appear.

Only active assessments associated with IT Risk Management are listed, including those where the template was created in that product or the assessment was launched from it. To view all assessments in the application, go to PIA & DPIA Automation > Assessments > Active. If you do not have access to PIA & DPIA Automation, contact OneTrust Support about subscriptions that include it.

Important:

You can assign the Assessment Details View permission to custom roles to let users access the assessments assigned to them, regardless of where the assessment was created. This permission is located in the Assessments permission group.

To review an assessment risk

  1. On the IT & Security Risk Management menu, select Assessments > Active.

    The Assessments screen appears.

  2. Click on the name of the assessment for which you want to view assessment risks.
    The assessment appears.
    Note:

    You cannot view assessment risk for assessments in the Not Started status.

  3. Click the Risk Flag icon.
    The Risks pane appears.

  4. Select the risk you would like to review and edit the fields as needed.
  5. Click the Save button to save any changes made.

To submit a treatment plan

After reviewing the risk, the risk owner can submit the risk treatment plan. The treatment status is updated using the system workflow and the risk now becomes view only for the risk owner. At this point, the system deadline and reminder field will begin evaluating. The deadline will be for the risk approver to approve the treatment plan or send it back.

  1. Open a risk with a proposed recommendation in the Flagged Risks pane.
  2. Click the Submit button.
    The Submit Treatment Plan modal appears.
    Note:

    This button only appears if the approver has moved the risk to the Treatment stage.



  3. Enter a comment before submitting the treatment for review.
  4. Click the Submit button. The assessment approver will be notified of the change in the risk status.

To request an exception

After reviewing the risk, the risk owner can request an exception. This action closes the risk in the chosen state and it will not be mitigated further. The risk approver can grant the exception or send the risk back to the risk owner. Sending the plan back to the risk owner will reset the treatment status to In Progress.

  1. Open a risk with a proposed recommendation in the Flagged Risks pane.
  2. Click the Request Exception button.
    The Request Exception modal appears.
    Note:

    This button only appears if the approver has moved the risk to the Treatment stage.



  3. Enter a comment before submitting the exception that explains the reason for the exception.
  4. Click the Submit button. The assessment approver will be notified of the change in the risk status.

To approve a treatment plan or grant an exception

Note:

Only the risk approver can approve a treatment plan or grant an exception.

  1. Open a risk in the Flag Risks pane. 
  2. Click either the Approve or Grant Exception button. This notifies the Risk Owner that the remediation or exception has been approved.
  3. Complete the required fields in the modal and click the Confirm button.




To send back a risk

Note:

Only the risk approver can send a risk back for further review.

  1. Open a risk in the Flag Risks pane. 
  2. Click the Send Back button. This notifies the Risk Owner that the treatment plan or exception has been declined and requires further review.

To add tasks to an assessment risk

Important:

The View risk tasks and Create risk tasks permissions alone does not grant access to the task list on risk records. To view the task list, the user must be one of the following:

  • Risk owner

  • Risk approver

  • Risk manager

  • A user with at least one task assigned on that risk

  1. Open a risk in the Flag Risks pane.
  2. Select the Tasks tab.
  3. Click the Add task button.
    The Add task modal appears.

    Field
    Description
    Task name

    Enter a name for the task.

    Description

    Enter a brief description of the task.

    Mark task as required

    Enable this setting to require tasks to be completed before moving to another stage.

    Assignee

    Select the user responsible for completing the task.

    Priority

    Choose the priority level of the task.

    Task collaborators

    Select the user responsible for helping the task assignee complete the task.

    Deadline

    Select the date by which the task must be completed.

  4. Complete the fields.
  5. Click the Save button.

To add controls to a risk

  1. Open a risk in the Flag Risks pane.
    Note:

    Controls cannot be added to risks with a status of Reduced.

  2. Select the Controls tab and click the Add Control button. =
    The Add Controls modal appears.

  3. Select the framework from which the controls you want to add originate.
  4. Select the check boxes for the control(s) you want to add.
  5. Click the Add button.
    Note:

    Controls added to a risk in an inventory assessment will update the associated inventory record with the added control once the assessment is approved.

To change the status of a control on a risk

  1. Open a risk with an associated control in the Flag Risks pane.
  2. Select the Controls tab.
  3. Click the checkbox of the control(s) in which you would like to change statuses.
  4. Click the Update Control Status icon.
    The Update Status modal appears.

  5. Select the status you want to update the control to from the Control Status field.
  6. Click the Confirm button.