What is an assessment?
An assessment is the review of a risk or a control to ensure that it is defined correctly or that its definition remains appropriate over time.
An assessment may
- focus on objects themselves, or on activities involving object, such as certification or audit
- be batch or ad-hoc
- concern a single risk or control, or encompass many.
- Involve the participation of business stakeholders, internal and external auditors, or other users.
- Incorporate test plans for controls
To determine what an assessment is meant to uncover, you assign one or more activity types to it. assessment activity types include:
The Assessment Page
- An Introduction page presents an overview of the item being assessed. It includes guidance text, which is a broad statement of the assessment's purpose.
- A "Review Prior Results" page displays records for any prior actions taken for this assessment.
- An "Enter Test Results" page enables you to complete a test plan. It appears only if you are assessing a control for which a test plan has been created.
- Use the response field to select an answer to an activity question. This determines whether the object passes or fails the assessment. You can also create a summary statement, create an issue, or attach a file to the assessment.
Batch Assessments follows the flow:
A batch assessment depends on several components
- A template designates a primary object of assessment, Risk and Control. The template also designates one or more activities to be completed in assessments.
- From the template, you develop a plan. It may contain filters that select instances of the primary object specified by the template.
- From a plan, you initiate an assessment, selecting object instances made available by the plan.
A batch assessment offers an array of options:
- It not only involves multiple object instances, but also may designate multiple activities to be completed
- Its generation involves the use of supporting tools: templates and plans. You use these to select assessment activities to define a set of objects for assessments.
- You Initiate it and manage the components that support it within the Assessment work area
Initiating a Batch Assessment
- Provide the general information
- Review the selection criteria
- select risks or controls to be assessed
- review participants
The final page in the initiate assessment series identifies the assessors for each risk or control selected for assessment. These people are selected according to role assignments, and you cannot modify that selection in this page.
The purpose of this review is to identify risks or controls that have no assessors, so that you can return to the components page and remove them from the assessment
Adhoc Assessments
An adhoc assessment is simpler:
- It not only focuses on a single object, but also designates a single activity to be completed
- You initiate it from within the page to manage the risk or control you want to assess
Completing an Assessment
An assessment may include any number of risk or controls. You assess each of these individually. You May:
- Select a Worklist notification for a risk or control included in the assessment
- Select the "Complete Assessment" option in the tasks panel tab of any page in the Assessments work area. In a search page, search of an Assessment, select one of its risks or controls, and select "Complete Assessment".
- Navigate to the Assessments tab of the Management page for the risk or control being assessed. Select the row for an Assessment and the "Complete Assessment" action.
