Conducting a Risk Assessment - Workflow

Platform: Risk Assessment Platform

Applies to:  End-user roles (e.g. Standard, Approver) 

Workflow

The workflow section provides an overview of the allocation and status of risk factors and controls. This feature also allows the allocation of the risk and control analysis workload across a team. 

The workflow page consists of 3 tabs:

• Workflow Summary - The status of each risk factor and control and to whom they are allocated.
• Assign Risk Factors - A list of the risk factors in the model and the ability to set assignees and approvers for each.
• Assign Controls - A list of the controls added to the assessment unit and the ability to set assignees and approvers. Controls are added to the assessment unit from the Controls Assessment page.

Workflow Summary

The workflow summary provides a breakdown of the risks and controls, by status and by assignee/approver.

Responsibilities:

• Assignee - First-line doer/reviewer
• Approver - Second/third/fourth line approver/reviewer

Statuses:

• Not Assessed - No updates have been made to the risk or control.
• In Progress - The analysis has started, but not all questions in the risk are answered.
• Awaiting Submit - The analysis has started, and all questions have been answered, but the risk or control has not been submitted for review/approval.
• Awaiting Approval - The analysis has been submitted and is awaiting approval.
• Approved - The analysis has been approved.

Workflow - Assign Risk Factors

This screen allows risk factors to be allocated between team members. There can be one (1) assignee and up to three (3) approvers per risk factor.

Use the checkboxes to select the risks to allocate based on the Group, Category (optional) and Risk Factor hierarchy.

Select users from the Assignee and Approver dropdown lists and press the Update button.

Note: New users can be set as Assignees before they have activated their accounts. These 'pre-activation' users appear in the Assignee dropdown list with an asterisk beside their name and can be selected.

Note: Deactivated users also display an asterisk beside their name but do not appear in dropdown lists and cannot be selected.

To define additional approval steps, use the Add Approver button (), up to a maximum of three.
Note: At least one Approver must be different to the Assignee.

Use the Filter button () to expand the filter window to filter by Group, Category, Status, Assignee or Approver.

Workflow - Assign Controls

This screen allows the controls to be allocated between team members. There can be one (1) assignee and up to three (3) approvers per control.

Add controls to the assessment unit on the Controls Assessment page.

Use the checkboxes to select the controls to allocate based on Category and Control hierarchy.

Select users in the Assignee and Approver dropdown fields and press the Update button.

Note: New users can be set as Assignees before they have activated their accounts. These 'pre-activation' users appear in the Assignee dropdown list with an asterisk beside their name and can be selected.

Note: Deactivated users also display an asterisk beside their name but do not appear in dropdown lists and cannot be selected.

To define additional approval steps, use the Add Approver button (), up to a maximum of three.
Note: At least one Approver must be different to the Assignee.

Use the Filter button () to expand the filter window to filter by Group, Category, Status, Assignee or Approver.

Notifying Assignees and Approvers

After users are allocated to their respective risks and controls, they can be immediately notified.

Note: This is in addition to the automatic notifications to Approvers when a risk or control is submitted and awaiting approval, and to Assignees when a risk or control is reopened.

Use the checkboxes to select the risks or controls for which to send the notification email, and press the Notify button.

Assignees are sent notification emails for:

• Risks that are Not Assessed, In Progress, or Complete
• Controls that are Not Assessed or Complete

Approvers are sent notification emails for:

• Risks that are Awaiting Approval where they are the current approver
• Controls that are Awaiting Approval where they are the current approver