Skip to main content

Get help for ARIS Risk and Compliance

Perform compliance assessments

As soon as compliance assessments are generated and the assessment period was reached, the regulation owner or hierarchy owner responsible can view the compliance assessments My tasks or in My GRC tasks in ARIS. By default, compliance assessments are opened in My GRC tasks in ARIS. For detailed information, refer to Perform or review compliance assessments in the online help of ARIS. How to perform compliance assessments in ARIS Risk and Compliance is described below.

You can Hand over object hand over or Delegate object delegate objects to another role.

Prerequisite

You have the Regulation owner or Hierarchy owner role.

Procedure. Procedure

  1. Open the list of compliance assessments.

    1. Click Home Home > My tasks. Your tasks are displayed. Initially, tasks with the Open status are displayed.

    2. Filter the list with the Compliance assessment object type.

    3. Check the due date. To do so, sort the list in Sort ascending ascending or Sort descending descending order by clicking the column header.

  2. Perform compliance assessments

    1. Click the name of the compliance assessment you want to edit. The Compliance assessment form is displayed with information such as related regulation, regulatory requirement, and activities, as well as assigned risks, hierarchy elements, and compliance assessment definition.

    2. Based on this information, assess whether the related regulations have been complied with.

    3. Edit the optional fields. Assign documents with further information, if necessary.

  3. Save your entries and select the status.

    1. Click Save Save. Your entries are saved. The status is automatically set to In progress. If you want to continue later, keep this status.

    2. If you want to complete the assessment, select the status Compliant, Not compliant, or Not possible depending on your results. Provide a reason for the status Not compliant, or Not possible.

    3. Depending on the result of your assessment, generate an issue based on the compliance assessment to, for example, adapt a process and initiate a confirmation process to inform employees, or initiate a policy roll-out to ensure the regulation is complied with from now on.

    4. If you changed the status, save your entries again (Save).

Your entries are saved. If you selected the status Not compliant or Not possible, the regulation managers responsible receive a notification by e-mail to initiate the necessary measures.

By default, compliance assessments with status Not compliant or Not possible require a review. Administrators can configure in the Risk and Compliance configuration of ARIS Administration (Configuration Configuration > Risk and Compliance > SYSTEM CONFIGURATION > Workflow management > Configuration > Task reviews > Control test) whether and how many reviews are required. If reviews are required, review tasks are generated for the reviewers responsible in My GRC tasks in ARIS.

If the compliance assessments are not edited within the predefined assessment period, they receive the Not completed status when checked and can no longer be edited.