Who is this article for?

Administrators who need to create an internal assessment.

Administrator access to the Universe module is required.

This article explains how to create an internal assessment for risks and controls, including bulk assessment options and local matrix considerations.

1. Creating a single assessment

1.1 Creating a single assessment

1. Right mouse click on the selected risk or control.
2. Select Assessment
3. Make Assessment
4. Complete the property fields
5. Click save.

The current assessment will be displayed for the corresponding risk or control. All historic assessments will be stored and available for future reference.

1.2 Risk assessment

1.3 Control assessment

2. Creating bulk assessments

The Risk Register screens (at all levels) have been improved so that risks and controls can be assessed in bulk.

1. Use the CTRL key on your keyboard and mouse to multi select the records.
2. Complete the assessment for all selected items.

3. Understanding local matrices

Note: If Local Matrices has been enabled in system settings, the following applies:

• The Likelihood, Impact and Score fields are all implicitly the Local values
• Group assessment fields become available in the column picker (these are set by the Group to Local mappings when the local matrix was created)
• The Group fields are available in the expander bar so you can filter by them
• The Group fields are available in analysis so you can chart by them
• Each Entity could have a different Matrix Configuration configured and a warning will be displayed if any bulk assessment operation is not valid

4. Understanding risk assessment properties

When creating a risk assessment, the following properties are available:

4.1 Entity Risk

• Assessment Type (internal or external)
• Name (read only)
• Description - A description for the assessment (rich text format)

4.2 Inherent

• Inherent Likelihood (very remote, remote, possible, probable and very probable)
• Inherent Impact (very light, light, moderate, severe and very severe)
• Inherent Score – linked to risk matrix (low, medium and high)

4.3 Residual

• Residual Likelihood – as above
• Residual Impact - as above
• Residual Score – as above

4.4 Assessment

• Category - segmentation
• Description (i.e. Notes) - (rich text format)

5. Understanding control assessment properties

When creating a control assessment, the following properties are available:

5.1 Entity Control

• Assessment Type (internal or external)
• Name (read only)
• Description - Description for the assessment (rich text format)

5.2 Rating

• Design (poorly, adequately and well designed)
• Operation (not, partially and fully operating)
• Score – linked to control matrix (ineffective, partially effective and effective)

5.3 Assessment

• Category - segmentation
• Description (i.e. Notes) - (rich text format)