Configuring Assessment Scoring

Note:

An Advanced license is required to access assessment score profiles in the IT & Security Risk Management, Third-Party Risk Management, PIA & DPIA Automation, Third-Party Due Diligence, and Data Mapping Automation modules.

You can now build score profiles and add response values for multi-select, numerical single select attribute, and yes/no questions for AI Governance, ITRM, Vendor, PIA & DPIA Automation, Third-Party Due Diligence and Data Mapping templates. After creating a score profile, you can create conditional rules for triggering various actions depending on the score profile output, like launching assessments or creating tasks. Benefits of this feature include:

  • The ability to score per specific domain or sections of an assessment.

  • Providing another way to tier assessment and automate follow-up actions and assignments based on responses.

  • Reducing the number of risks produced from assessments as follow-up actions.

Note:

Currently, risk related questions and response types are not supported.

What is a Score Profile?

Score profiles can be configured in the template builder to help support complex assessment scoring based on assessment responses for specific risk domains or sections of an assessment. Score profiles output a score once the assessment is completed. Various score profiles can be created based on your question types, sections, and business units. Currently, score profiles can be created in the following modules:

  • AI Governance

  • Data Mapping

  • IT & Security Risk Management

  • PIA & DPIA Automation

  • Third-Party Due Diligence

  • Third-Party Risk Management

To create a score profile

  1. On the IT & Security Risk Management menu, select Setup > Templates.
    The Templates screen appears.
    Note:

    You can also create a score profile in the Third-Party Risk Management and Data Mapping Automation, PIA & DPIA Automation, and Third-Party Due Diligence modules by following the steps in this section.

    An Advanced license is required to access assessment score profiles.

  2. Click the View button on the ITRM Templates tile.
  3. Open a draft of an existing template.

    The Template Builder appears.

  4. Select the Details tab.
  5. Activate the Enable Score Profile setting.
    Note:

    The Enable Score Profile setting must be active in order to view the Score Profiles tab.

  6. Click the Save button.
  7. Select the Score Profiles tab.
  8. Click the Create Score Profile button.
  9. Complete the fields. For more information, see Score Profile Configuration Screen Reference.
  10. Click the Save button.

Score Profile Configuration Screen Reference



Field
Description
Score Profile Name

Enter a name for the score profile.

Questions

  1. Click the Select button, choose the question(s) you want to relate to this score profile, and then click the Next button. Currently, only yes/no, multiple choice, and numeric single-select attribute questions of risks and inventories from the template can be chosen. Multiple choice questions are averaged per question and then added into the final score calculation.

  2. If the Allow Multiple Selections setting is enabled, you can manage the aggregation method for multi select questions. You will be prompted to manage these selections on the Manage Multi-Select Aggregation Method modal.

  3. Click the Done button to return to the configuration screen.

Note:

You can click the Manage button after selecting questions to add or remove questions.

Scoring Type

Select the scoring type you want to use to score the questions. The options available are:

  • Average

  • Max

  • Min

  • Sum

  • Weighted Average - This option will require you to enter weighted values for each question. Only whole numbers and decimal values between 0-100 are accepted.

To create score profile rules

Once you have created a score profile, you can configure rules to take actions based on the outcome of the score profile.

  1. On the Template Details screen, select the Rules tab.
  2. Click the Add Rule button.
  3. Configure template rule conditions based on the Assessment Score. For more information, see Template Rule Conditions.
  4. Configure template rule actions. For more information, see Template Rule Actions.
  5. Click the Save button.

Template Rule Conditions

The template rule conditions are configured to initiate certain actions if any or all of the conditions are met. You can create individual conditions or combine conditions using the Add Condition Block button to create complex automation logic. When combining multiple conditions, you can choose whether any of the conditions can be met to initiate the rule action or if all conditions must be met to initiate the action. This section explains how to configure single or multiple conditions to initiate template rule actions.



Section

Field

Description

Conditions

Any

If you select Any, the template rule will be initiated if any one of the conditions are met.

Note:

This option only appears if you add more than one condition to the template rule.

All

If you select All, the template rule will only be initiated if all of the conditions are met.

Note:

This option only appears if you add more than one condition to the template rule.

Condition Block

Trigger

Select Assessment Score.

Assessment Score Profile

Choose the score profile which you would like to based the rule.

Operator

Select the relationship that must be met between the field and value. The following operators are available:

  • Greater Than

  • Less Than

  • Greater Than Or Equal To

Assessment Profile Score

Enter the assessment profile score value that will trigger the rule.

Add Condition Block

N/A

Click the Add Condition Block button to add more conditions to the workflow rule.

Template Rule Actions

Rule actions determine what happens when the conditions you define are met. Each action gives you control over how triggered conditions are handled, so you can standardize outcomes, reduce manual updates, and make sure the correct next step is applied consistently.

Configure Template Rules to Add Approvers Upon Submission

You can configure template rules to automatically add an assessment approver once the assessment is submitted.



Field
Description
Actions

Select Add approvers upon submission.

Approver

Select the user or user group responsible for approving the assessment.

Configure Template Rules to Create Issues

You can configure template rules to automatically create a new issue based on the assessment score. Issues are created when the assessment is submitted, not when the score is recalculated on assessment approval.



Field
Description
Actions

Select Create Issue.

Name of Issue

Enter a name that describes the issue.

Approvers

Select the users responsible for approving the issue.

Assign Current Assessment's Approver

Check this box if you would like to assign the current assessment approver as the issue approver.

Category

Select the issue category that applies to this issue.

Deadline

Enter the number of days after the issue is created that the deadline will be set.

Description

Enter a brief description that describes the issue.

Owners

Select the users responsible for managing the issue.

Assign Current Assessment's Approver

Check this box if you would like to assign the current assessment approver as the issue owner.

Assign Current Assessment's Respondent

Check this box if you would like to assign the current assessment respondent as the issue owner.

Priority

Select the priority level of the issue.

Configure Template Rules to Create Risks

You can configure the template rules to automatically create a new risk based on the assessment score. Risks are created when the assessment is submitted, not when the score is recalculated on assessment approval.

Note:

Risks created from Score Profile rule conditions will not be linked to an assessment question. It will be linked directly to the assessment. For example, once the rule condition is triggered for the rule configured below, the risk created will be linked to the assessment only - not to any assessment question.





Field
Description
Actions

Select Create Risk.

Select a Risk From the Library

Choose this option if you would like to choose an existing risk from the library.

Create New Risk

Choose this option if you would like to create a net new risk. For more information, see the Create New Risk Screen Reference.

Add Risk Control

Click the Add Risk Control button to add a control to the risk from the Control Library or to create a new custom control.

Configure Template Rules to Create Tasks Upon Submission

You can configure the template rule to automatically create and assign tasks within your organization.



Field
Description
Actions

Select Create Task upon Submission.

Task Name

Enter a name for the task.

Assignee

Select an assignee for the task.

Deadline

Enter a deadline date for the task.

Collaborators

Select collaborators for the task.

Assessment Respondent

Check this box if you would like the assessment respondent to be added as a collaborator.

Assessment Approver

Check this box if you would like the assessment approver to be added as a collaborator.

Description

Enter a detailed description of the task.

Configure Template Rules to Send Assessment Upon Approval

You can configure the template rules to automatically launch an assessment upon approval when the specified conditions are met.



Field
Description
Actions

Select Send Assessment upon Approval.

Template Name

Select the assessment template launched by the rule.

Deadline

Enter a deadline for the assessment.

Reminder

Enter the number of days before the assessment deadline that the respondent will receive a reminder.

Approver

Select the new assessment approver.

Respondent

Select the new assessment respondent.

Require Confirmation Upon Approval

Enable this setting to require the approver to confirm if the triggered assessment should be sent upon approval.

Configure Template Rules to Send Assessment Upon Submission

You can configure the template rules to automatically launch an assessment upon submission when the specified conditions are met.



Field
Description
Actions

Select Send Assessment upon Submission.

Template Name

Select the assessment template launched by the rule.

Deadline

Enter a deadline for the assessment.

Reminder

Enter the number of days before the assessment deadline that the respondent will receive a reminder.

Approver

Select the new assessment approver.

Respondent

Select the new assessment respondent.

Automatically Approve Assessment

Enable this setting to automatically set the assessment to Completed if an additional assessment is triggered.

To add assessment response values

You can add response values for numerical single select attribute, multichoice, and yes/no questions in the Question Builder when the Enable Score Profile setting is enabled.

  1. On the Template Details screen, select the Builder tab.
  2. Click the Edit icon for the question in which you would like to add an assessment response value.
    Note:

    This option is only available for numerical single select attribute, multichoice, and yes/no questions.

    The Question Builder modal appears.

  3. Complete the Response Values fields next to each option. This will be used to calculate the assessment score.
    Note:

    Only whole numbers between 0-100 are accepted.

  4. Click the Save button.

To view assessment scoring results

  1. On the IT & Security Risk Management menu, select Assessments > Active.
    The Assessments screen appears.
    Note:

    You can also view assessment scoring results in the Third-Party Risk Management and Data Mapping Automation modules by following the steps in this section.

    An Advanced license is required to access assessment score profiles.

  2. Open the assessment in which you want to view the scoring result.
  3. Click the Context Menu icon and select Edit Details.
    The Edit Details pane appears.

  4. The Assessment Score field displays the results of the assessment scoring.
    Note:

    Assessment risk scores and individual risk scores are related, but separate values. An individual risk’s score and level are calculated from the risk attributes configured in Attribute manager. An assessment-level score and level are aggregated from the risks associated with the assessment.

    Assessment aggregation is configured separately in Global Settings and does not automatically inherit the individual-risk scoring methodology or customized level names. As a result, the level displayed in assessment metadata may differ from the level displayed on the corresponding individual risks.

Understanding Assessment Scoring Calculations

In OneTrust, assessments collect responses and support the calculation of scores such as risk, impact, or overall ratings. These calculations are based on how your organization's configured scoring models. Assessment calculations only evaluate data that is explicitly within the assessment's context and object relationships. There is no implicit expansion of scope across the data model.

What's Included in Calculations?

Item

Description

Assessment responses

  • Values from questions completed in the assessment

  • Any mapped numeric or attribute values

Attributes populated by the assessment

  • Direct question and attribute mappings

  • Custom attributes used in formulas

  • Score-type or formula-type fields that consume those values

Data from explicitly linked objects

  • Only objects directly related to the assessment's primary context are considered

  • Calculations do not include: cross-object inference, automatic traversal of unrelated relationships, and full graph evaluation

How do assessment calculations work?

Assessment calculations follow this general process:

Step 1

Users complete assessment questions.

Step 2

Assessment responses are captured as values (e.g. numeric or mapped values).

Each question will capture a response and depending on your configuration, responses may be:

  • Assigned a numeric value (e.g. 1-5)

  • Mapped to predefined scoring values

  • Captured in custom fields for future use in calculations

Step 3

Configured scoring logic evaluates the values.

As mentioned in this article, scoring logic is configured by your organization and scores are calculated based on these scoring models. The scoring models are configured outside of the assessment itself and determine how values are evaluated. This may include:

  • Formulas, such as averages, weighted calculations or custom equations

  • Risk matrices, such as combining impact and probability to generate a risk score

Step 4

Scores are calculated and reflected in risks and reporting.

Based on the scoring logic configured, the system can produce impact and probability values, inherent or residual risk scores, and custom calculated fields. These results are then used in risk records, reporting and dashboards, risk workflows, and decision making.