Overview
ZenGRC provides Task templates to complement your Risk Management workflow. s assist your team's due diligence surrounding identified risks by providing templates that autofill with text that you define.
Task Templates
In the risk settings/tasks tab there are 4 templates(Accept, Transfer, Remediate, Avoid), where admins can define how the automatic task creation modal will be populated.
Each template has 6 fields:
Title
Description
Assignees
Reviewers
Verifiers
Related object (this one is locked always)
And a checkbox to notify the assignee.
The Title and Description fields can hold variables listed on top of the page - in the form of %...%. The three variables are: %object% , %object_title%, %object_description% .
When a variable is added to a field, the field will contain the information from the variable on the actual task creation.
On the risk objects an actionable button is added, which is always descriptive of what will happen. The actionable button transfers the risk object to the upcoming status. For some statuses the actionable button is a "dropdown", so the user can select what he wants to do.
An additional feature is, that when a risk object is transferred from "identified" to "under assessment" through the actionable button, then the risk scoring tab automatically opens.
Note: statuses can still be freely changed on the top-right, the actionable button just follows the risk lifecycle, but it is not enforced. To tie into the templates - when a risk object with the actionable button is transferred from:
assessed → accepting
assessed → transferring
assessed → avoiding
remediate → in remediation
Then a task creation modal will pop up, populated with information from the relevant task template.
The task from this modal does NOT have to be created to automatically transfer the status. The task creation can be cancelled and the status will still automatically transfer.
An additional thing to note is, that when a risk object is transitioned with the actionable button, and a "non-admin" is the owner, then the task creation modal will not show up (because readers can't create tasks), but the status will transition.
Functional spec:
https://reciprocitylabs.atlassian.net/wiki/spaces/ZenGRC/pages/570032494/Essential+Risk+Milestone+4
Risk settings/ task tab on dev3 instance:
https://dev3.zengrc.com/settings/risk/tasks