...
...
...
...
...
...
...
...
- --- - No rating. The control has not been rated. The page defaults to this.
- Effective - The control's design works as intended.
- Ineffective - The control's design does not work as intended.
- N/A - Rating the design is not applicable or can't be done.
...
- --- - No rating. The control has not been rated. The page defaults to this.
- Effective - The control is operating as intended.
- Ineffective - The control is not operating as intended.
- N/A - Rating the operational effectiveness is not applicable.
...
| Tip | ||
|---|---|---|
| ||
You can also create an issue from this dialog box if problems are found. Click Create Issue to map the issue to this assessment. Then follow the instructions in the Creating Issues section of this tutorial. |
...
Overview
Viewing and Evaluating Control Assessments
| Info | ||
|---|---|---|
| ||
This section describes actions conducted on the Audit summary page, which opens from the Audits visual display page. |
To view and evaluate a control assessment on the Audit summary page, complete the following steps:
...
| Tip | ||
|---|---|---|
| ||
If you need additional information or need to decline the assessment, add your reasons in the Comments text box. |
| Live Search | ||||||||
|---|---|---|---|---|---|---|---|---|
|
Benefits
A control is an activity or technical configuration put in place to satisfy a requirement, which is called an objective in ZenGRC. Controls are the only objects that are tested in the Audits module, which are then "assessed" in an assessment. Assessments are typically performed after evidence showing the control in action has been submitted.
Overview
This documentation highlights additional functionality that audit managers or administrators may need. For streamlined steps on how to finish your portion of an assignment, please see Quick Tips for Assessments.
When an audit is started, assessments are automatically created on a one-to-one basis with the audit's controls. Assessments rate the effectiveness of a control in both design and operation. To make the process more efficient, you can review the associated details of the control (title, description and, test plan) on the assessment itself. In order to perform the control assessment, the related objectives (on the Design tab) and the related evidence requests (on the Operational Effectiveness tab) can be reviewed on the assessment card as well.
After reviewing the necessary information, the assessor can evaluate the control on a design and operational effectiveness level. Typically, if a control receives an “Ineffective” rating in either category, then a corresponding issue is created. See the issue creation process in Working with Issues.
| Info | ||
|---|---|---|
| ||
Audit managers and those with additional permissions access requests from the Audits module, while those with limited permissions access assessments from the To-Do List. See details of access rights in Role-Based Permissions. |
Accessing Control Assessments from Audits
This section describes actions conducted on the Audit summary page, which opens when an individual audit is clicked in the Audits module.
On the Audit summary page, complete the following steps:
- Click the Assessments tab.
- Find the control assessment and click the link in the Title column.
Accessing Assessments Through the System of Record
To access requests, complete the following steps.
- Click System of Record | Assessments.
- The Assessments page displays showing all existing items.
Accessing Assessments from the To-Do List
Those with limited permissions who are assigned assessments will only have access to them from their To-Do List.
| Info | ||
|---|---|---|
| ||
For additional information, please see To-Do List. |
Evaluating Assessments
For streamlined steps on how to finish your portion of an assessment, please see Quick Tips for Assessments.
Filtering Control Assessments in Audits
Narrow control assessments displayed on the Control Assessments tab within an audit by utilizing the filter functionality.
To filter
...
...
...
- The page refreshes with results.
Exporting Control Assessments
Information in a control assessment can be exported for external auditors or any other reviewers your organization may have. The export can be formatted as a CSV or as a zip file with the attachments inside.
| Include Page | ||||
|---|---|---|---|---|
|
Setting Up Recurrence
Requests, assessments and tasks can be set up to repeat on a monthly, quarterly, semi-annual, and annual basis.
| Include Page | ||||
|---|---|---|---|---|
|