Skip to main content

Get help for ARIS Risk and Compliance

Edit control tests

As soon as control tests are generated and the start date of the testing period is reached, the control tester roles responsible can view the control tests in My tasks or in My GRC tasks in ARIS. By default, control tests are opened in My GRC tasks in ARIS. For detailed information, refer to Edit or review control tests in the online help of ARIS. How to edit control tests in ARIS Risk and Compliance is described below. You can Hand over object hand over or Delegate object delegate objects to another role.

Prerequisite

You have the Control tester role.

Procedure. Procedure

  1. Open the list of control tests.

    1. Click Home Home > My tasks. Your tasks are displayed. Initially, tasks with the Open status are displayed.

    2. Filter the list with the Control test object type.

    3. Check the due date. To do so, sort the list in Sort ascending ascending or Sort descending descending order by clicking the column header.

  2. Edit the optional fields.

    1. Click the name of the control test you want to edit. The Control test form is displayed with information such as test type, testing activities, test size, as well as assigned risks, controls, and control test definitions.

    2. Edit the optional fields.

    3. Assign documents with further information, if necessary.

    4. You can assign change or improvement recommendations that can serve as additional information in an audit, for example. The recommendation can be sent automatically after you have completed the task if you enter an e-mail address and the e-mail functionality is configured. Alternatively, you can send the e-mail manually (Send message).

  3. Save your entries, select the status, and initiate further measures, if required.

    1. Click Save Save. Your entries are saved. The status is automatically set to In progress. If you want to continue later, keep this status.

    2. If you want to complete the control test, select the status Test passed, Test failed, or Test not possible depending on the result.

    3. If you selected the status Test failed:

      1. Describe the test in detail so that someone who is not familiar with the process can reproduce the results when repeating the test. If only one test type (Test of control design or Test of control effectiveness) is specified for the control test, the failure type is automatically given: Design test failed or Effectiveness test failed. If both test types are specified for the control test, the control tester must specify which of the two failed or if both failed.

      2. Specify the measure, this means whether a deficiency, an issue or no further measure is to be initiated.

    4. If you selected the status Test not possible enter a reason.

    5. If you changed the status, save your entries again (Save).

Your entries are saved. If you saved the status Test passed, Test failed, or Test not possible, you can no longer edit the control test.

By default, control tests with status Test failed, Test passed, and Test not possible require a review. Administrators can configure in the Risk and Compliance configuration of ARIS Administration (Configuration Configuration > Risk and Compliance > SYSTEM CONFIGURATION > Workflow management > Configuration > Task reviews > Control test) whether and how many reviews are required. If reviews are required, review tasks are generated for the reviewers responsible in My GRC tasks in ARIS. The users responsible are notified automatically by e-mail.

If you initiated a deficiency or an issue as a measure for the control test, the corresponding object is generated automatically. The deficiency is then edited by the deficiency manager (L1) in the next step. If you are logged in as a deficiency manager (L1), you can edit the deficiency immediately. The control tester is assigned to the issue as an issue creator. The issue is displayed in your list of issues and can be edited immediately.

If control tests are not tested within the specified testing period, they are automatically closed during checking and are given the status Not tested.

Next steps: