Page Comparison

Overview

This step allows you to add all evidence requests at once. Audit tasks and evidence requests are created in an audit by importing a template containing the required data. Then, those tasks and requests are mapped to the scoped controls.

Image RemovedImage Added

This step actually contains several sub-steps within it. They include the following activities, which are outlined on this page:

1. Downloading the import template.
   
   

   Tip
   title TIP
   For an external audit, use the import template to transfer information from the Document Request List (DRL), which was received from your external auditors.

   
   

   Tip
   title TIP
   For an internal audit, use the import template to add requests and tasks you feel evidence requests for controls that are pertinent to your internal compliance program.

   
   

2. Completing the template.
3. Importing the template into ZenGRC.
4. Mapping the imported requests to the scoped available controls.

The Import Requests Template

ZenGRC supplies the import requests template with preformatted headings describing the information you need to enter to fulfill the audit requirements.

pre-formatted headings that correspond to request fields. 

Anchor
downloadingthetemplate downloadingthetemplate

Downloading the Template

To download the import requests template, complete the following step:

1. Click click here to download it link. The CSV file will open or download in the manner specified in your browser.
   

Image Removed

1. 
   Image Added
   

Anchor
completingthetemplate completingthetemplate

Completing the Template

For an external audit, transfer the DRL information into the import template using provided headings.

For an internal audit, add requests and tasks Add requests surrounding the audit into the import template using provided headings.

Image Added

Image Removed

The request import template contains the following fields:

• Request - This is the type of data you are importing. The cells under this heading stay blank.
• Title - This must be unique for every request so users can easily identify specific tasks when looking at a large amount of requests. The title limit is 250 characters. This is a required field.
• Description - An optional field for instructions on the evidence-collection task.
• Notes - An optional field for additional remarks.

• Assignee - The user's email who will be fulfilling the evidence request. Make sure the email is already set up in the ZenGRC application. When a request is assigned or when comments are added to the request, the assignee receives notifications. This is a required field.

• Reviewers - An optional field for a review reviewer who accepts or rejects the evidence prior to the verifier, who accepts or rejects the evidence. Fill in the user's email. 

• Verifier - An optional field for who should verify the user who has the final review of this evidence request. Fill in the user's email. Make sure this user has an account with this email in ZenGRC. Users receive email notifications when the assignee submits evidence or when there are new comments.

• Starts On - A required date field for when the request starts. If empty, the application posts a warning and will fill in the blank with the date the template is uploaded. The format should be MM/DD/YYYY. This is a required field.

• Due On - A date field for when the request is due. The format should be MM/DD/YYYY. ZenGRC uses this data for overdue calculations and warnings.
  
  

Anchor
importingthetemplate importingthetemplate

Importing the Template

Image Removed

To import the template containing your audit requests, complete the following steps:

1. Click Choose CSV to Import Requests.
   
   Image Added
   
   
2. Select the template saved in the previous section.

   Click Open. The application displays a message with import information.

   Image Removed
    
3. Click Import Requests. Alternatively, click Cancel if there are errors to correct.
4. Click Next.
   Info

   title	NOTE

   To continue this step and map requests, please see Mapping Requests to Scoped Controls

   Now follow the instructions under Importing a Template in Data Import.
   
   

   Info
   title NOTE
   After importing requests, please see Mapping Requests to Available Controls.

   
   

Adding Individual Requests

On First Access to the Page

On first visit to the Step 3. Requests tab, if you want to create and add requests individually, complete the following:

1. Click Add Requests Individually.
   
   Image Added
   
   
2. The form for creating a new request displays.
   
   Image Added
   
   
3. Once saved, the request will display in the mapper to add to controls.

After Importing Requests

After importing requests, but prior to activating the audit, you can still add requests manually by doing the following:

1. Click + Add More Requests at the bottom of the page.
   
   Image Added
   
   
2. This displays the page shown in the screenshot under the Overview section of this documentation where you can import a spreadsheet or create requests individually.

Anchor
mappingrequeststocontrols mappingrequeststocontrols

Mapping Requests to

Available Controls

Once you have imported requests, the page displays to map them to audit controls.

Image Removed

The page for mapping requests to an audit is It is comprised of three columns as follows:

• titleTIP

  In-Scope Available Controls – These are controls scoped to the audit in the second step Step 2. Scope. 
  

  Tip

  
  

  A red box with a “0” indicates that the control has no associated requests and needs attention.

• Requests Mapped to the Control Requests Mapped – This contains all requests mapped to the in-scope selected control. The column is blank when the page is initially accessed since the imported requests have not yet been mapped.

• Requests to Map Available Requests – These are requests added to the template and imported for the audit. Any imported request can be mapped to any control within the audit.
  
  Image Added
  
  

Mapping Requests

To map requests to a scoped control, complete the following steps:

1. Select a control in the In-Scope Available Controls column. 
   
   

   Tip
   title TIP
   Selecting a control displays all mapped and unmapped requests to that specific control.

   Image Removed
   Click the plus button on

   
   

   Image Added
   
   

2. Select a check box next to a request in the Available Requests column. This activates the Map Requests button.
3. Alternatively, select the Select All check box to Map columnchoose all requests in the column.
4. Click Map Requests.
   Image Removed
   Image Added
   
   
5. The request moves to the Requests Mapped to the Control Mapped column and is now scoped mapped to the control.
   Image Removed
6. Continue until all appropriate requests are mapped to the control.
7. Select another control in the In-Scope Available Controls column and repeat the process.
    

Unmapping Requests

To remove requests from a scoped control, complete the following steps:

1. Select a control in the In-Scope Available Controls column. This displays all associated controlsrequests.Image Removed
   
2. In the Requests Mapped to the Control column, click the minus button beside the control to be removed.
3. Select a check box next to a request in the Requests Mapped column. This activates the Unmap Requests button.
4. Alternatively, select the Select All check box to choose all requests in the column.
5. Click Unmap Requests.
   
   Image Added
   
   
6. The request is removed from the control and added to the Available Requests to Map column column.

Displaying Descriptions

To read descriptions of any control or request displayed, complete the following steps:

1. Select an objective in the In-Scope Controls item in any column.
   
2. Click the Details link. The description displays and the link says Hide Details.
   Image Removed
   Alternatively, click Hide Details to remove the description from display.
   Image Removed 
   
   Image Added
   
   
3. The control or request opens in a new tab or window and displays all pertinent information.

Opening the Mapper Page

If you were interrupted during mapping and need to return to the mapper page, complete the following:

1. On the Step 3. Requests tab, click Show mapper.
   
   Image Added

Anchor
completethestep completethestep

Completing the Step

Image Removed
The step is ready for completion after requests have been imported and then mapped to scoped controls.

To complete this step and continue to the review, complete the following:

1. Click Next. The Review Step 4. Assessments page displays.
   
   

   Info
   title NOTE
   Continue to the next section - Step 5: Reviewing and Starting the Audit4: Generating Assessments.