FAQ: Frequently Asked Questions

During audit creation, controls are added in Step 2: Scope. Then assessments are automatically generated for those controls when you complete Step 5: Review. On that page, you will see how many assessments will be generated after you click Start Audit. See Creating an Audit.

If you need to add an assessment after audit creation, complete the following steps:

1. Click the blue New button at top left (of any module).

2. Select Assessment.

3. In the Audit dropdown, select the audit for which you're creating the assessment.

4. Complete the necessary fields and click Save.

5. Map the control and the assessment to the audit.

6. Map the control to the assessment. See Mapping and Unmapping in Fundamentals of Navigating and Editing.

This can happen if the request is not mapped to the control in Step 4 of Audit Creation. If this occurs, you can correct it by completing the following steps:

1. Click System of Record | Requests.

2. Select the check box beside the request, and click Map/Unmap.

3. Click Select Object Type and select the Control radio button.

4. Find the applicable control in the Available Controls column and click + to add it.

5. Click Complete. See Mapping and Unmapping in Fundamentals of Navigating and Editing.

No. Assessments are meant for controls and are only automatically generated for them when the audit is started. If an assessment or a request is added through import, there is no auto-generation. However, if you add a request and map it to a control that already has an assessment, the request will show up on the mapped assessment.

Here are some instructions for changing any field in an existing, active audit:

1. Click Audits and select your audit.

2. Go to Actions in the top right corner

3. Choose View Audit Details. Here you can edit desired fields. Please see Editing Overall Audit Details in the Managing Audits documentation.

If there is still a step to complete when the due date passes, such as the outside auditor verifying the evidence, ZenGRC recognizes it as overdue.

If you don't want your statuses to say overdue, update the Due On date to reflect the actual day that evidence verification can take place.