Skip to main content

Get help for ARIS Risk and Compliance

Evaluate deficiencies L1

Control test reviewers check the control tests that control testers have valuated with the status Test failed. They review the control tester's results and decide whether there is a deficiency. If there is a deficiency, it is automatically assigned to the deficiency managers level 1 responsible, who are automatically notified by e-mail.

Prerequisite

You have the Deficiency manager (L1) role.

Procedure. Procedure

  1. Open the deficiency you want to edit.

    1. Click Home Home > My tasks. Your tasks are displayed. Initially, tasks with the Open status are displayed.

    2. Filter the list with the Deficiency object type.

    3. Click the ID of the deficiency you want to edit. The Classification for the deficiency is displayed.

  2. Edit the classification.

    1. In the Affected organizational units row, click Create assignment/Assign Assign to assign the organizational units of the company that are affected by the deficiency. These must be modeled in the company organizational chart and be available as hierarchy elements in ARIS Risk and Compliance.

    2. Edit the optional fields, for example, company code, location, and country of the subsidiary.

  3. Edit the description.

    1. Describe the deficiency in detail by editing the mandatory fields (Mandatory field, Recommended field).

    2. Edit the optional fields. For example, enter the start/end of the control period the deficiency refers to. This can be necessary to unambiguously assign the deficiency to a sign-off period later.

  4. Edit the valuation.

    1. Edit the mandatory fields (Mandatory field, Recommended field) and the optional fields.

    2. If required, enter the link to compensation control level 1, as well as a note on compensation control level 1 and whether the compensation control on level 1 was tested effectively.

    3. By documenting the compensation controls, you provide a detailed evaluation of the deficiency. To do this, you must check whether controls are already implemented, for example, in a downstream step in the process that could identify the deficiency. This does not change the frequency of occurrence of the deficiency, but the magnitude can be reduced. If the evidence for a compensation control is already available in ARIS Risk and Compliance as an effective test, you can assign it directly in the system (Link to compensation control level 1).

  5. Edit the status and save your entries.

    1. Edit the mandatory fields (Mandatory field, Recommended field).

    2. Once you have specified all required entries, select the status Approved.

    3. Click Save Save. Deficiency editing is completed for this level.

Your entries are saved. This releases the deficiency for the next editing level. The deficiency now has the status Released in your list of deficiencies. You can still view your entries and those from any subordinate level (if available), but you can no longer change them. If you selected the status In progress, your entries are saved and you can continue editing the deficiency at a later time.

Next step: Evaluate deficiencies L2