Overview of the item generation process

By using the Governance, Risk, and Compliance application, you can use the item generation process to generate controls and risks for your organization.

A control is the actual control activity that an organization performs. For example, a control can be related to authoritative source content (legal articles, regulations, or public records), policies, and risks. A control is automatically generated when you associate a policy with an entity type (grouping of the entities that match a set of filter conditions) or an entity type with a control objective. For more information on controls, see Manage controls.

The item generation process (v1) in version 12.x.x and earlier releases generated out-of-sync updates due to the stalled actions in the action queue. The enhanced item generation process (v2) eliminates the stalling issues and improves the processing time of the controls and risks significantly. For example, the legacy item generation process (v1) generated 10,000 risks in approximately 13.7 minutes where the new item generation process (v2) can generate 10,000 risks in approximately 5.27 minutes.

Flow of the item generation process

The item generation process inserts an action in the action queue and executes the actions one by one in a sequence. A scheduled job runs periodically to check the action queue. If an action is running in the queue, the scheduled job skips it. When the current running action is completed and no other action is in process, the scheduled job picks up the next action in the Ready state in the queue as shown in the following example.

Benefits of the item generation process

The new item generation process provides the following key benefits:

• Processes the controls and risks quickly by using the item generation action event queue.
• Eliminates the stalled actions and race conditions​ in the queue that generated the non-consistent updates.
• Logs the history and status of the item generation actions.
• Provides more information about an error in the item generation action event queue. It helps you to track and troubleshoot the issues quickly and efficiently.
• Helps the compliance and risk managers to manage the controls and risks in an auto-pilot mode without much maintenance.

Applications that are used in the item generation process

The GRC: Profiles application is automatically installed when either the GRC: Policy and Compliance Management or GRC: Risk Management application is activated.

Upgrade scenarios and their impact on the existing implementations

You must upgrade both Policy and Compliance Management and Risk Management applications to version 13.x.x. When you upgrade the Policy and Compliance Management and Risk Management applications to version 13.x.x, the new item generation process (v2) replaces the legacy item generation process (v1).

The error message states that you must upgrade both Policy and Compliance Management and Risk Management applications to version 13.x.x as shown in the following example.

Components that are used by the item generation process

The item generation process uses several types of reference components such as tables, scheduled jobs, and action handlers. For more information on the components that are used with the item generation process, see Components installed with the item generation process.

Using the scheduled job and action event queue

The item generation process uses the Item generation action queue processor scheduled job and an action event queue in the background. As a user with the sn_grc.admin role, you can configure the frequency of the scheduled job as shown in the following example.

When you initiate an action that results in generating, updating, or deleting a control or risk, the scheduled job inserts a record for each action in the sn_grc_item_generation_action_event_queue.list table. The item generation action event queue is shown in the following example.

When an action is generated by using the item generation process, a message that the item generation process has been initiated is displayed. For example, when you add a risk statement to a control objective, you see the message that is shown in the following example.

If an error occurs while processing an action in the queue, the item generation process displays more information about the error. For example, you might see an error trace with the object ID as shown in the following example.

You can use the error trace and other details in the queue to track and troubleshoot the issue.

Script includes action handlers

The item generation process uses the script includes action handlers that process the actions for the Policy and Compliance Management and Risk Management applications.

You can view the list of the supported action handlers by navigating to Script Includes in the application navigator as shown in the following example.

All script includes action handlers contain the base version and the extended version. The item generation process uses the base version for handling the actions. As a user with the sn_grc.manager role, you can review the base functions that are listed in the action handler as shown in the following example.

As a user with the script_include_admin role, you can revise the action strategy for a control or risk by overriding the base functions as shown in the following example.