Flagging Risks on an Assessment

The risk approver can flag risks and propose remediation steps on a completed assessment.

Note:

Invited Users have the ability to reassign risk owners when flagging risks on an assessment in the under-review stage of the assessment workflow when the Allow Invited Users to Re-assign Risk Owner setting is enabled in Global Settings.

Viewing Active Assessments in IT & Security Risk Management

There is more than one Assessments screen in the OneTrust application. Different assessments appear in different product areas of the application due to:

  • The type of template used to create the assessments

  • The type of OneTrust subscription purchased, which gives access to different data available across the application

It follows that not all assessments will appear in the IT & Security Risk Management Assessments screen. Assessments based on primary records (i.e. assets, entities, vendors, etc.) will not appear. Only active assessments associated with IT & Security Risk Management will be listed here if any of the following are true:

  • The assessment template was created in IT & Security Risk Management.

  • The assessment was launched from IT & Security Risk Management.

To view all assessments available in the application, navigate to the PIA & DPIA Automation menu, then select Assessments > Active. If you do not have access to PIA & DPIA Automation, contact customer support to learn about subscriptions that include access to this product.

To flag risks on an assessment

Users assigned as an assessment Approver, or users with the Create risks permission, can flag risks within an assessment. However, these users cannot access or view the associated risk record unless they have the appropriate risk-viewing permissions.

  1. On the IT & Security Risk Management menu, select Assessments > Active.

    The Assessments screen appears.

  2. Click on the name of an assessment with the status Under Review.
  3. Click the Review button to open the assessment and flag risks.
  4. Click the Flag Risk icon next to a question in which you would like to flag a risk.
    The Flag Risk modal appears.
    Note:

    If you flag a risk on a non-primary inventory question while the assessment is in the Under Review state, the risk is only soft-inherited by the inventory. In this case, if you navigate to the Related tab of the flagged risk, and manually relate the non-primary record, an "Entity already exists" error message will appear.

    To resolve this issue, complete and approve the assessment. After approval, all inventories associated with the risk appear on the Related tab of the flagged risk.

  5. Complete the fields. For more information, see Flag Risk Screen Reference.
  6. Click the Add button to add the risk to the assessment.

    Click the Save and Add Controls button to add the flagged risk to the assessment and add related controls to the risk. You can add a control from the Controls Library or you can create a new custom control.

Flag Risk Screen Reference



Field
Description
Select a Risk From the LibraryCreate New Risk

Select an existing risk from the library or create a new risk.

Inherent Risk Level

Select the level of risk you want to flag.

Note:

If you have risk heatmaps enabled, you will be able to choose the level of risk based on the heatmap set up for your organization.

If you do not use risk heatmaps, the available options will be low, medium, high, and very high.

Risk Name

Enter the name of the risk.

Threat

Select the threat(s) the risk presents.

Vulnerability

Select the vulnerability category the risk falls into.

Category

Select the associated category the risk falls under.

Risk Owner(s)

Select the name(s) responsible for remedying the risk.

Risk Approver(s)

Select the name(s) responsible for approving the risk.

Deadline

Select a deadline by which the risk must be resolved.

Reminder

Enter the number of days before the deadline which the respondent(s) should be reminded to complete the risk assessment.

Description

Enter a description of the risk and why it has been flagged.

Treatment Plan

Enter a plan to control, mitigate, and/or resolve the risk.

Understanding risk owner and approver assignments

When you launch a risk assessment, OneTrust assigns the Risk Owner and Risk Approver based on whether a primary record is identified and whether the configured user type attributes contain values.

  • If no primary record is identified, the Risk Owner defaults to the Current Assessment Respondent and the Risk Approver defaults to the Current Assessment Approver upon submission of the risk assessment. If the Current Assessment Approver value is unavailable, the field remains blank.

  • If a primary record is identified, the Risk Owner and Risk Approver defaults to the primary record user type attribute configured in the template action rules. If no user type attribute value is found, the Risk Owner defaults to the Current Assessment Respondent and the Risk Approver defaults to the Current Assessment Approver.

  • In invited user scenarios, if a user type attribute is identified, that user is assigned as the Risk Owner. The invited user receives an email invitation only when the risk moves to the Treatment stage and that user is assigned as the Risk Owner. In this scenario, the Risk Approver defaults to the Current Assessment Approver upon submission of the risk assessment if a value is available; otherwise, the field remains blank.

  • If no attribute question is answered, OneTrust falls back to the inventory user type attribute configured in the template action rule. If that value is also empty, the Risk Owner defaults to the Current Assessment Respondent and the Risk Approver defaults to the Current Assessment Approver.

  • If the template includes an inventory question with a user type attribute, and that same attribute is configured to assign the Risk Owner or Risk Approver, OneTrust uses the user type attribute response only when the inventory is the primary record.

To view risks flagged on an assessment

  1. Open an assessment that has a status of Under Review or Complete. 
  2. In the header for the assessment, click the Flag Risk icon button.
    The Risks pane appears.

  3. In the Risks pull-down menu, select the type of risks you want to view.

    Select All Risks to view all risks associated with the assessment.

    Select Assigned to Me to view all risks assigned to you.

    Select Open Risks to view risks which have been flagged, but do not have a treatment plan.

    Select Pending Treatment to view risks in the Treatment workflow stage without a treatment plan.

    Select Pending Approval to view risks which have a treatment plan but are pending approval.

    Select Invalid Risks to view risks that have been flagged, and may no longer be valid. This may occur when a previous assessment response is changed and the existing flagged risk is no longer valid.

  4. Click the Close icon to close the Risks pane.

To manage invalid risks

In cases where an assessment response that previously flagged a risk was changed by a respondent, a notification will appear during the assessment review. The notification will inform approvers that the existing flagged risk may no longer be valid and may impact records in the Risk Register. This notification is usually triggered when assessment responses that impact previously flagged risks were changed when the assessment was sent back by approvers. When the notification appears, you have the option to retain, unlink, or delete the risks.

  1. Open an assessment that has a status of Under Review. Assessments with invalid risks will have a notification in the assessment header.

  2. Click the View Risks button next to the invalid risk notification. The Risks pane will appear.

  3. Choose to retain, unlink, or delete the invalid risk. A confirmation modal appears.
    Note:

    This action cannot be undone.

    • If you retain the invalid risk, the risk will not be deleted from the Risk Register, and it will remain on the assessment.

    • If you unlink the invalid risk, the risk will not be deleted from the Risk Register, but it will be removed from the assessment question.

    • If you delete the invalid risk, the risk will be deleted from all assessments and inventories the risk is linked to.

  4. Click the Retain, Unlink, or Delete button on the confirmation modal.

To delete or unlink a flagged risk

You can delete or unlink risks flagged on an assessment.

  1. Open an assessment that has a status of Under Review or Complete. 
  2. In the header for the assessment, click the Flag Risk icon button.

    The Risks pane appears.

  3. Select the risk you want to delete or unlink.
    Note:

    Deleting the risk will permanently remove the risk from all related assessments and inventories. Unlinking a risk completely removes the risk association from the assessment. In some cases, this could make the risk a standalone risk and lost in the risk registrar

  4. In the header of the risk pane, select the Context Menu icon.


  5. On the Context menu, select Delete or Unlink.

    The related modal appears.

  6. Click the Delete or Unlink button.

To advance risks to the treatment stage

In order to notify the risk owner(s) that they have been assigned a risk, the risk approver must advance the risk to the Treatment stage. In the Treatment stage, the risk is actively mitigated by the risk owner. During this time, tasks are completed, control statuses are updated, and the treatment plan is executed.

  1. Open an assessment that has a status of Under Review or Complete. 
  2. In the header for the assessment, click the Flag Risk icon button.

    The Risks pane appears.

  3. Select the risk in which you would like to advance the risk to the Treatment stage.
  4. Click the Treatment stage in the risk workflow.
    The Advance Stage modal appears.

    Field
    Description
    Risk Owner

    Select the risk owner(s) responsible for mitigating the risk.

    Treatment Plan

    Enter the treatment plan details. This may include completing specific tasks, assigning a risk owner, and adding controls to mitigate the risk.

  5. Complete the required fields.
  6. Click the Save & Advance button to move the risk to the Treatment stage. To continue this process, see Managing Risks in an Assessment.