Configure and publish a control effectiveness assessment to assess the effectiveness
of controls in mitigating risks.
Vorbereitungen
Role required: sn_risk.admin
Warum und wann dieser Vorgang ausgeführt wird
Configure the control assessment criteria with details such as factors, the scoring
logic, and the rating criteria. You can also specify if you would like to assess the
complete control environment or if you would like to assess controls individually.
These details are the aspects on which the risk assessment is performed. You can
also enable the options to add existing controls or new controls during an
assessment. This exercise ensures that each risk assessment methodology (RAM) has
its own control assessment criteria.
Prozedur
-
Navigate to the RAM form that has inherent risk as an assessment type.
-
Under the Assessment Types related list, select Control Assessment.
-
On the form, fill in the fields.
-
Select the Factors section and select Edit.
The Factors related list appears only when Control environment assessment is selected from the Calculate based on field.
-
Add the necessary factors from the Collection list to the Factors list, and select Save.
-
Select the Qualitative Rating Criteria related list and select New.
-
On the form, fill in the fields.
Hinweis: Don’t enter negative values in the Qualitative Rating Criteria form.
-
To define the assessment result mapping for the applicable record types, do the following actions:
These steps apply when conducting the control assessment on an object.
-
Select the Assessment Result Mapping related list.
The Assessment Result Mapping related list appears only when the Update assessment results to source record option is selected in the RAM.
-
Select the record type.
-
On the form, fill in the fields.
Hinweis: If the same record type is used in another risk assessment methodology, the source record will update based on the field defined in the RAM of the latest advanced risk assessment.
-
Select Update.
-
Select Submit.
-
Select Publish.