Who is this article for?

Users who want guidance on completing a risk review in Assurance.

Full User Type and Person Responsible permissions are required.

You may be notified to complete a formal risk review, if a review is required for your risks. Assurance will send a reminder to the person responsible for the risk, to complete the risk review before it becomes overdue.

This article walks you through the process of accessing and completing an assigned risk review.

1. Accessing a risk review

To access a risk review, follow the link in the reminder email notification that you have received or find the risk review on your To Do List.

2. Updating a risk review

To update a risk review:

1. Select the Risk Review button.
   You will be taken to the edit screen.
2. Make any changes to the risk assessment or fields as required.
3. Select the Update button.

Risk information still current?
You do not need to make any changes if the information is still current, but you must select the Update button to complete a risk review.

Changing a risk's First Review Date?
Assurance is a governance, risk and compliance (GRC) tool. We do not recommend changing the risk's First Review Date once it has passed. Changing the First Review Date can often lead to user confusion and misalignment in reporting. Rather, adjusting the review's Repeat Frequency to reflect the nature of the risk ensures transparency and accountability, which are crucial in a GRC environment. Learn more on how to update risk review's Repeat Frequency.

3. Completing a risk review

Once you have updated a risk, a yellow pop-up message will prompt you to apply the changes to any outstanding risk reviews.

To complete a risk review:

1. Tick the risk review(s) you would like to complete
2. Add any comments as needed.
3. Select the Done button.
   If you have edited the risk but you do not want this to be the risk review, select the Complete Review Later button.

Have overdue risk reviews?
You have the flexibility to adjust your risk assessment at any time in between required risk reviews. If you have an overdue risk, it is recommended that you review it using the process outlined in this article.

Making ad-hoc changes to risk assessments?
If you have an ad-hoc change to make to your risk assessment in between formal risk reviews, you may complete a risk assessment instead.