Creating and Managing Business Objectives

Important:

The Business Objectives feature is available for customers with solution packaging only.

The Export Risks and Business Objectives to PDF feature is under Public Preview. Please contact OneTrust Support to request early access.

Business objectives are specific, measurable outcomes that an organization aims to achieve in order to fulfill its mission, vision, and other strategic goals. Objectives provide a clear and concise expression of what the organization seeks to accomplish within a defined time frame. The Business Objectives menu within IT & Security Risk Management allows you to create and manage objectives.

Business objectives serve as the foundation for identifying, assessing, and managing risks. They act as a roadmap for the organization, guiding its efforts while considering the uncertainties and risks that may impact the achievement of the objectives. You can align objectives with business priorities to better inform decisions and assure efforts are directly supporting your organization's strategic direction.

Business Objective Benefits

  • Enhance visibility for leadership teams and risk owners to prioritize actions based on the risks most likely to impact business objectives.

  • Quickly translate risk management activities as a value-add work-stream for the organization to achieve business objectives.

To create business objectives

  1. On the IT & Security Risk Management menu, select Governance Principles > Business Objectives.

    The Business Objective screen appears.

  2. Click the Create New or Add New button.

    The Create New modal appears.

  3. Complete the fields. For more information, see Create New Modal Reference.
  4. Click the Save button to create the business objective record. Click Save And Add New to create the business objective record and immediately create a new record.

Create New Modal Reference



Field
Description
Name Required

Enter a name for the business objective.

Category Required
Select one or more category that the objective falls into.
Note:

You can add your own unique options using the Risk Category Manager.

Organization Required

Select the organization responsible for completing the business objective.

Description

Enter a brief description of the business objective.

Deadline

Select the date by which the business objective should be completed.

Owner(s)

Select the individuals responsible for the completing the business objective.

Reviewer(s)
Select the individuals responsible for reviewing the business objective.
Note:

This field appears if you expand the Show Fewer Details section.

Approver(s)
Select the individuals responsible for approval the business objective.
Note:

This field appears if you expand the Show Fewer Details section.

Status

Choose the current status of the business objective.

Note:

You can active or deactivate system status options or add your own unique options using the Objective Attribute Manager.

To delete business objectives

  1. On the IT & Security Risk Management menu, select Governance Principles > Business Objectives.

    The Business Objective screen appears.

  2. Click the checkbox in the ID column for the objectives you'd like to delete.

  3. Click the Delete button.

    The confirmation modal appears.

  4. Click the Confirm button to delete the record.

To add attachments to business objectives

  1. On the IT & Security Risk Management menu, select Governance Principles > Business Objectives.

    The Business Objective screen appears.

  2. Open the objective in which you would like to add attachments.
  3. Select the Documents tab.
  4. Click Add Links to add a URL and description to the record or click the Add Documents button to attach a file and description to the record.




  5. Click the Save button.
    The attachment will now appear on the Documents tab.

To add tasks to business objectives

  1. On the IT & Security Risk Management menu, select Governance Principles > Business Objectives.

    The Business Objective screen appears.

  2. Open the objective in which you would like to add tasks.
  3. Select the Tasks tab.
  4. Click the Add Task button.
    The Add Task modal appears.

    Field
    Description
    Task name

    Enter a name for the task.

    Description

    Enter a brief description of the task.

    Assignee

    Select the individual responsible for completing the task by the deadline.

    Priority

    Select the priority level of the task.

    Task collaborators

    Select the individuals that will help complete the task.

    Deadline

    Enter a deadline by which the task must be completed.

  5. Click the Save button to create the task. Click the Save and Add Another button to create the task and immediately create another task.

To add comments to business objectives

  1. On the IT & Security Risk Management menu, select Governance Principles > Business Objectives.

    The Business Objective screen appears.

  2. Open the objective in which you would like to add comments.
  3. Click the Comments link.
    The Comments pane appears.

  4. Type a comment in the comment box using the text editor as needed. You can mention users directly within comments using the icon to trigger both an in-app notification and email notification.
    Note:

    This comment will be visible to all users with access to the business objective.

  5. Click the Add button.

To add risks to business objectives

  1. On the IT & Security Risk Management menu, select Governance Principles > Business Objectives.

    The Business Objective screen appears.

  2. Open the objective in which you would like to add risks.
  3. Select the Risks tab.
  4. Click the Add Risk button.
    The Flag Risk modal appears.

  5. Select the risks that impact the business objective.
  6. Click the Save button. The risks will be added to the Risks tab and the aggregated risk score will be updated on the Risks and Details tab.
Important:

How is this aggregated risk score calculated?

The aggregated risk score is calculated using the residual risks related to the business objective. Residual risks are the risks that still exists after control mitigation and risk management efforts have been implemented.

The aggregated risk score is a score-type attribute that can be customized in the Attribute Manager. The formula, score levels, and level colors can be customized based on the needs of your organization to populate based on your residual risks.

To view business objective activities

  1. On the IT & Security Risk Management menu, select Governance Principles > Business Objectives.

    The Business Objective screen appears.

  2. Open the objective in which you would like to view related activities.
  3. Select the Activity tab to view the history of the business objective.

To advance to the next workflow stage

  1. On the IT & Security Risk Management menu, select Governance Principles > Business Objectives.

    The Business Objective screen appears.

  2. Open the objective in which you would like to advance to the next workflow stage.
  3. Click the Next Stage button.
    The business objective will be moved to the next stage of the workflow.

To change the workflow

  1. On the IT & Security Risk Management menu, select Governance Principles > Business Objectives.

    The Business Objective screen appears.

  2. Open the objective in which you would like to change the workflow used.
  3. Click the Change Workflow button.
    The Change Workflow modal appears.

    Field
    Description
    Workflows

    Select the published business objective workflow you would like to use.

    Stage

    Select the workflow stage you would like to set.

    Apply stage rules at beginning of next stage

    Enable this setting to run all stage rules at the beginning of the next stage.

  4. Complete the required fields.
  5. Click the Save button.

To export objectives

Exporting as XLSX file

  1. On the IT & Security Risk Management menu, select Governance Principles > Business Objectives. The Business Objective screen appears.

  2. Click the Export button. The Export objectives modal appears.

  3. On the Export objectives modal, select the type of export.

  4. Click the Export button. The report will be generated in the background. When the report is ready to download, a notification will appear on the Notifications icon.

  5. Click the Notifications icon. The Notifications popover appears.

  6. Click the link corresponding to the report you exported. The file will download to your local system.

Exporting as PDF file

  1. On the IT & Security Risk Management menu, select Governance Principles > Business Objectives. The Business Objective screen appears.

  2. Click the check box next to the business objective(s) you would like to export as a PDF file.

  3. On the Business objective screen, click the Context Menu icon in the screen header and select Export as PDF. The Export modal appears.

  4. On the Export modal, customize the naming convention of the exported file.

  5. Click the Export button. The Report download modal appears.

  6. Click the Close button. The report will be generated in the background. When the report is ready to download, a notification will appear on the Notifications icon.

  7. Click the Notifications icon. The Notifications popover appears.

  8. Click the link corresponding to the report you exported. The file will download to your local system.