Step 3: Setting up Audit Requests

Overview

This step allows you to add all evidence requests at once. Audit tasks and evidence requests are created in an audit by importing a template containing the required data. Then, those tasks and requests are mapped to the scoped controls.

This step actually contains several sub-steps within it. They include the following activities, which are outlined on this page:

1. Downloading the import template.
   
   

   TIP

   For an external audit, use the import template to transfer information from the Document Request List (DRL), which was received from your external auditors.

   TIP

   For an internal audit, use the import template to add evidence requests for controls that are pertinent to your internal compliance program. 

2. Completing the template.
3. Importing the template into ZenGRC.
4. Mapping requests to available controls.

The Import Requests Template

ZenGRC supplies the import requests template with pre-formatted headings that correspond to request fields. 

Downloading the Template

To download the import requests template, complete the following step:

1. Click click here to download it link. The CSV file will open or download in the manner specified in your browser.
   
   
   

Completing the Template

Add requests surrounding the audit into the import template using provided headings.

The request import template contains the following fields:

• Request - This is the type of data you are importing. The cells under this heading stay blank.
• Title - This must be unique for every request so users can easily identify specific tasks when looking at a large amount of requests. The title limit is 250 characters. This is a required field.
• Description - An optional field for instructions on the evidence-collection task.
• Notes - An optional field for additional remarks.

• Assignee - The user's email who will be fulfilling the evidence request. Make sure the email is already set up in the ZenGRC application. When a request is assigned or when comments are added to the request, the assignee receives notifications. This is a required field.

• Reviewers - An optional field for a reviewer who accepts or rejects the evidence prior to the verifier, Fill in the user's email. 

• Verifier - An optional field for the user who has the final review of this evidence request. Fill in the user's email. Make sure this user has an account with this email in ZenGRC. Users receive email notifications when the assignee submits evidence or when there are new comments.

• Starts On - A required date field for when the request starts. If empty, the application posts a warning and will fill in the blank with the date the template is uploaded. The format should be MM/DD/YYYY. This is a required field.

• Due On - A date field for when the request is due. The format should be MM/DD/YYYY. ZenGRC uses this data for overdue calculations and warnings.
  
  

Importing the Template

To import the template containing your audit requests, complete the following steps:

1. Click Choose CSV to Import Requests.
   
   
   
   
2. Select the template saved in the previous section.

3. Now follow the instructions under Importing a Template in Data Import.
   
   

   NOTE

   After importing requests, please see Mapping Requests to Available Controls.

Adding Individual Requests

On First Access to the Page

On first visit to the Step 3. Requests tab, if you want to create and add requests individually, complete the following:

1. Click Add Requests Individually.
   
   
   
   
2. The form for creating a new request displays.
   
   
   
   
3. Once saved, the request will display in the mapper to add to controls.

After Importing Requests

After importing requests, but prior to activating the audit, you can still add requests manually by doing the following:

1. Click + Add More Requests at the bottom of the page.
   
   
   
   
2. This displays the page shown in the screenshot under the Overview section of this documentation where you can import a spreadsheet or create requests individually.

Mapping Requests to Available Controls

Once you have imported requests, the page displays to map them to audit controls. It is comprised of three columns as follows:

• Available Controls – These are controls scoped to the audit in Step 2. Scope. 
  

• Requests Mapped – This contains all requests mapped to the selected control. The column is blank when the page is initially accessed since the imported requests have not yet been mapped.

• Available Requests – These are requests added to the template and imported for the audit. Any imported request can be mapped to any control within the audit.
  
  
  
  

Mapping Requests

To map requests to a control, complete the following steps:

1. Select a control in the Available Controls column. 
   
   

   TIP

   Selecting a control displays all mapped and unmapped requests to that specific control.

   
   
   
   

2. Select a check box next to a request in the Available Requests column. This activates the Map Requests button.
3. Alternatively, select the Select All check box to choose all requests in the column.
4. Click Map Requests.
   
   
   
   
5. The request moves to the Requests Mapped column and is now mapped to the control.
6. Continue until all appropriate requests are mapped to the control.
7. Select another control in the Available Controls column and repeat the process.
    

Unmapping Requests

To remove requests from a control, complete the following steps:

1. Select a control in the Available Controls column. This displays all associated requests.
2. Select a check box next to a request in the Requests Mapped column. This activates the Unmap Requests button.
3. Alternatively, select the Select All check box to choose all requests in the column.
4. Click Unmap Requests.
   
   
   
   
5. The request is removed from the control and added to the Available Requests column.

Displaying Descriptions

To read descriptions of any control or request, complete the following steps:

1. Select an item in any column.
   
2. Click the Details link. 
   
   
   
   
3. The control or request opens in a new tab or window and displays all pertinent information.

Opening the Mapper Page

If you were interrupted during mapping and need to return to the mapper page, complete the following:

1. On the Step 3. Requests tab, click Show mapper.
   
   

Completing the Step

The step is ready for completion after requests have been imported and then mapped to scoped controls.

To complete this step and continue to the review, complete the following:

1. Click Next. The Step 4. Assessments page displays.
   
   

   NOTE

   Continue to the next section - Step 4: Generating Assessments.