About Assess Risk Question Types

Important:

The assess risk question type and risk assessment feature is only available to customers with an IT & Security Risk Management subscription.

Overview

You can use the Assess Risk assessment question type to add attribute questions that capture information about risks. This feature allows you to utilize the OneTrust assessment capabilities when assessing risks during the initial risk evaluation or when engaging with risk owners in order to support risk mitigation.



The source of the risk is automatically assigned as an assessment when a new risk is created on an Assess Risk assessment question. This allows Risk Owners and Site Admins to easily view the risk source and relationship when a risk is created via an assessment and add that relationship to the Related tab. For more information on adding Assess Risk questions on an assessment, see Configuring Templates for Risk Assessments.

Things to Know

Risks created using the assess risk question in an assessment will not automatically appear under the primary record's Risk tab on the Risk details screen. However, you can manually link these risks to the inventory record of the assessment by opening the risk in the Risk register and adding the inventory using the Related tab on the Risk details screen. For more information, see Managing Risk Details.

Business Use Case

This feature allows you to complete risk assessments. You can capture information about existing risks from the assessment to view how they are managed by your organization. While assessing existing risks, you can review and update risk information as needed by editing the assessment fields.

You have the ability to assess a single risk on an assessment or multiple risks. To assess multiple risks, you can launch a single assessment on all selected risks or launch one assessment per selected risk.

Launching Risk Assessments

Once a template is configured and published using the Assess Risk question type, you can use the published template to launch an assessment. These assessments can be launched from IT & Security Risk Management in the following locations:

  • Risk register

  • Risk details screen