Who is this article for?

System administrators responsible for configuring email notifications for risk and control assessments.

Server Agent configuration access required.

The system provides optional email notifications to alert and remind risk owners when entity risks and controls are due for external re-assessment.

This article explains the different notification types and how to configure them.

Notification types

There are two types of email notifications:

• Initial notifications for entity risks and controls
• Reminder notifications for entity risks and controls

These notifications:

• only relate to entity risks and controls (not to library or audit levels)
• only relate to external assessments (never to internal assessments), because internal assessments are the domain of the audit team
• are sent with respect to entity risks and controls which do not have a current external assessment

Configuring notifications

Initial notifications

Initial notifications are sent based on fixed and configurable criteria.

Fixed criteria

• Business Owner is set (else there is no one to notify)
• Business Owner has an Email address set (else there is nowhere to send it)
• Current External Assessment does not exist

Additional criteria

These are configurable by network administrators:

• Active State is Live
• Risk Type or Control Importance Outcome = Included
• Due Date < Today + 28 days (the warning period can be varied)
• Notified Date is NOT set (to avoid them being sent more than once)

Entity risks and controls are combined into a single email per person.

For example, if a person is the business owner of 12 entity risks and 10 entity controls, all of which match the other criteria, they will receive two emails (one for entity risks and one for entity controls).

Note

The email parameters (Subject, Body, etc.) come from the Server Agent settings and can be modified by your network administrator. You cannot reference individual entity risks or controls in the email body or Cc others linked to them, as multiple records are combined into one email.

Setting notification dates

When the Initial notification is sent, each affected entity risk and control will have:

• their Notified Date set to Today (to avoid them being included again)
• their Respond by Date set to Today + Entity Risks Initial Respond By Days value

By default, this gives the business owner 7 days to act before they receive a reminder email.

Reminder notifications

Reminder notifications are sent based on fixed and configurable criteria.

Fixed criteria

• Business Owner is set (else there is no one to notify)
• Business Owner has an Email address set (else there is nowhere to send it)
• Current External Assessment does not exist

Additional criteria

These are configurable by network administrators:

• Notified Date is set
• Respond by Date < Today

In your Server Agent settings, you can choose to send reminders to each person as a single consolidated email or as individual emails. Consolidation means fewer emails, while individual emails can include a URL linking to the specific entity risk or controls.

Note

The email parameters (Subject, Body, etc.) come from the Server Agent settings and can be modified by your network administrator.

Setting notification dates

When a reminder is sent:

• the Respond by Date for the Entity Risk and Control is set to today
• the Entity Risks Reminder Respond by is set to three days by default, giving the business owner extra time before the next reminder.