How to configure risk-control surveys in GlobalSuite®

Phases for conducting Risk-Control Surveys

This guide will explain phases 1 and 2 of the survey creation process

Survey Models

GlobalSuite® allows identifying and classifying the inventory of items, performing risk analysis, and evaluating the organization's controls through surveys sent to various responsible parties within the organization. To do this, the survey template to be sent must first be created. Multiple templates can be created and configured to adapt them to the organization's needs.

For this purpose, each survey template can be configured by indicating its type. There are three types of surveys that can be considered when creating a template:

• Item Survey: Allows the identification of items, their categorization, and classification.

• Risk Survey: Allows the identification of risks for each element (including services and processes) as well as their evaluation according to the organization's methodology.

• Control Survey: Allows the identification of controls implemented in the organization as well as their maturity evaluation according to the corresponding methodology.

This guide will explain the functionality of the “Risk-Control Survey” type.

To configure a survey model, you must be an Administrator user (Platform Administrator, Enterprise Administrator, or Configuration Administrator), as it is located in the section Settings> Survey Models .

In this option, you must choose the type of survey model you want to create using the “ New Survey” button (in this case, the type “ Items, Risks, and Controls”). Additionally, in this option, you can delete models (button “ Delete”) and download a list of the configured models (button “ Download”).

The last column will show the templates that are enabled. Surveys can only be created from enabled templates.

Within the survey model, you can configure aspects such as the name, department, or creation date, as well as indicate whether the model should be enabled for use and whether you want to “Consolidate in the last state,” meaning that from the last state of the workflow, the survey data can be directly consolidated into the final analysis.

It is also possible to use states in the survey. Using these states allows different people to fill in or validate information entered in previous states. You can move from one state to another automatically by marking the indicator (automatic check) and also move back to a previous state in the same way, by marking the corresponding indicator (rollback check).

In the “Survey Type” section, you must choose what type of model you want to create.

In this case, the selected survey type is the most comprehensive as it contains the three combinations: Elements, Risks, and Controls.

Next, two sections are displayed that allow its configuration.

First, the “Additional Configuration” section is displayed, where you can choose which options you want to include in the survey:

By default, implemented controls are marked so that this type of controls is displayed in the survey.

To unmark this type of control, another type must be marked; therefore, it can only be unmarked when the option for treatment plans is also marked, which are controls that are under study and improvement and have not yet been implemented.

When treatment plans are marked, actions are also marked by default; it is not possible to mark treatment plans without actions.

Actions can also be included for implemented controls and evidence in the survey for both implemented controls and treatment plans.

In this way, when completing the survey and evaluating a control, or creating a new one, the actions of that control can be indicated, and its evidence can be attached.

Second, the “ Taxonomy” section (Types / Grouping of Risks), where you can select its configuration. You can choose whether it should be visible and editable in the survey. It is also possible to indicate the order in which it should be displayed.

In the following sections, the specific configuration for Risks and Controls is displayed.

In the “ Risk Survey” section, first, you must select which risk methodology you want to use in the survey. Once selected, the dimensions configured in the risk methodology are displayed, indicating the type of dimension and whether it is manual or automatic. The user can configure the following options for each dimension:

• Visible: allows defining whether the dimension will be included in the survey or not by clicking on the cell.

• Editable: indicates whether the dimension can be modified in the survey or will only be visible in consultation mode.

• Mandatory: indicates the requirement to fill in a dimension when changing states, in case surveys with states are used.

• Question: in the case of surveys of the "Form" type (to be seen later), allows displaying an explanatory question instead of just the name of the dimension.

  

When selecting a dimension, in the lower table (“Risk Levels”), the levels configured in Settings are displayed for informational purposes.

If a dimension is selected, it is possible to change the order in which it will appear. Using the “Move Up” and “Move Down” buttons, it can be positioned in the desired place.

With the “Update Dimensions” button, as indicated by the yellow message, the list of dimensions of the risk methodology is updated in case new dimensions have been added after the model's creation.

The settings for the previous dimensions that already existed are preserved; only the new dimensions created in the risk methodology appear to be included in the survey.

Finally, in the “Control Survey” section, the control methodology associated with the risk methodology selected in the previous section is already marked.

When selecting the methodology, the dimensions configured in it are displayed, just like in the risk sections.

With the “ Update Dimensions” button, as indicated by the yellow message, the list of dimensions of the control methodology is updated in case new dimensions have been added after the model's creation.

The settings for the previous dimensions that already existed are preserved; only the new dimensions created in the control methodology appear to be included in the survey.

In the “ Attachments” section, the necessary files can be attached to the survey so that the recipient can consult them.

The available options are:

• Select file: allows searching and selecting a file from our file explorer.

• Attach: allows uploading the selected file.

• Delete: allows deleting a file selected in the “Associated Documentation” table.

• Download: allows downloading the file selected in the “Associated Documentation” table.

• View: allows viewing the selected file in the “Associated Documentation” table from the browser. It is only possible to view files with the extensions .pdf, .jpeg, .jpg, .bmp, or .png.

Survey Configuration

Once the survey model is configured, it can be used to configure as many surveys as required. To do this, go to the option Management> Surveys

To create a survey configuration, you must filter by the survey type and then choose the desired template.

By clicking the “ New” button, a survey of the chosen type and model will be created. If you want to delete the configuration of a survey, you must click the “ Delete” button. Keep in mind that if a Configuration is deleted, all surveys created from this Configuration will also be deleted.

It is also possible to download the list of survey configurations in both Excel and PDF formats.

When accessing the survey configuration, a set of sections appears that allow its configuration.

In the first section, “General Configuration Data,” you can identify the configuration name, view the type and model of the survey, change the date, and also activate or deactivate the “ Enabled” check, which indicates whether the Configuration can be used to generate new surveys.

If states (Workflow) have been included in the modeling, then the configuration also includes the “States” section to assign a responsible person to each state:

In the “ Risk Configuration” section, information related to the selected survey type (Risks and Controls) appears.

Next, you must select which risk analysis you want to conduct the survey on. The list of risk analyses contains those analyses in GlobalSuite® that are configured with the same methodology associated with the survey model. When selecting the risk analysis, the associated risk catalogs appear at the bottom for informational purposes.

Another aspect to configure is the selection of the Elements to be incorporated so that the user receiving the survey can only evaluate the assigned elements (in addition to those added as new elements).

By clicking the “ Add Elements” button, a pop-up window opens with all the elements that are part of the element inventory. Filters can be used, either by the element's name or by category, as shown in the following image:

To select the items to include, you must check the box next to each item on the left side, and once selected, press the “Select Items” button.

With the “Dependency View” button, the items are displayed in the item tree to see the relationships between them.

Once the elements are added, at the bottom is the “Risks” table, which shows the risks of each element. By default, all risks are enabled so that the survey user can evaluate them, but it is possible to select only those risks you want to publish for each element.

Finally, when one of the risks is selected, all associated controls are displayed.

Once all the fields in the form have been completed, click the “Save” button, and the configuration is ready to be used.

From the “ Attachments” section, specific documents can be added to the configuration itself. Additionally, inherited documents from the survey model can be viewed and/or managed.