Creating an Issue for a Risk Control

You can create an issue for a control-based engagement risk assessment project (engagement level) and/or an individual risk control (control level.)

Engagement level

• You must be either the engagement requester or a Supplier Risk Engagement Governance Analyst user
• You can create an issue for a control-based engagement risk assessment project at any point from the time the request is approved until the time when engagement risk assessment project is finally approved or denied

Control level

• You must be a decision maker for the control and its control review task must be active
• You can create an issue for an individual risk control if it requires a review in the current control-based engagement risk assessment process and the review task is active

The issue document includes a standard set of questions about the issue name, description, assignee, severity, and due date. It might also include a question about the issue probability.

• The specific wording of these questions and the other questions in the issue form are defined by your organization's issue management process

If residual risk is set up in your site, the Residual Risk field on the issue page shows the residual risk of the issue based on the severity and probability you selected.

• If the issue is the only issue for the engagement, or it is the issue with the highest residual risk for the engagement, the engagement page also shows the same residual risk