My Risks Dashboard

With the Risk and Compliance Module, treatment The processes, policies, or actions added to risk items to reduce the likelihood and negative impact of the risk occurring. sign-off stakeholders are notified through the My Dashboard > My Risks page when they are required to sign-off a treatment. The following notifications are displayed:

  • Risk sign-offs that are due within a specified number of months
  • Changes to risk treatments
  • Risks to be assessed
  • Risks to be reviewed

Access the My Risks dashboard

  • Go to My Dashboard > My Risks. The details displayed on the page are described in the table below. To filter the notifications, click on the Filter button and select one of the following options from the right-side panel:

    • All

    • Treatment Sign offs due in <choose from the drop-down list>

    • Treatment Changes to Review

    • Risks to Assess

    • Risk Reviews due in <choose from the drop-down list>

Promasters A Nintex Process Manager system administrator who administers a Nintex Promapp site and has rights to view and edit all areas of a Nintex Promapp site., Risk Owners and Risk Managers Any user who undertakes a training unit, competency unit or onboarding, responsible for completing training as scheduled and to record completion if "self sign-off" is required. can configure the treatment sign-off and risk review features.

Column/Option Description
Risk Displays risk details and links to the Risks > Register page.
Status Displays the status. For example, Overdue, Signed-off.
  • Green - the treatment is not yet due.
  • Orange - the treatment sign-off is due or near the due date.
  • Red - the treatment is overdue.
Due Date Due date for the change to be actioned.
Treatment Displays treatment details and links to the Risks > Register page.
Process The name of and link to the process.
Type Type of notification. For example, Treatment sign-off
Involvement Displays the role or responsibility you have with regards to the risk.
Users Click the icon to display the other users responsible for sign-off. They display in the right-side panel. You can send a reminder notification to the users by clicking the Remind users button.

The following actions are displayed, depending on the risk:

  • Assign to me: Informs other sign-off stakeholders that you will take necessary actions and sign-off when they are complete. You can attach files and/or include a comment for more details.
  • Sign off: Confirms that a treatment has been applied or that a process step is operational and effective. You can attach files and/or include a comment regarding the effectiveness of the treatment.
  • Non-compliant: Shows that the treatment is not in place, has not occurred, or that it is ineffective. If you select this option, you must add a comment to explain the issue.
  • Sign off for all: Sign off on behalf of all users to confirm that a treatment has been applied or that a process step is operational and effective. You can attach files and include a comment regarding the effectiveness of the treatment.

    Note: If stakeholders complete individual sign offs before this option is used by a Promaster or another stakeholder eligible to use this option, the individual sign-offs and the sign off for all will be recorded as dashboard notifications and within the audit record under treatment sign off history.

  • Remind user: Opens a new email that can be sent as a reminder to other users about the treatment.

    • Important: Selecting the Non-compliant sign-off option will escalate the risk sign-off to the Risk Portfolio Manager A user responsible for assigning incidents for investigations, approving actions plans, and closing risk and compliance items for a portfolio. and other escalation stakeholders Users who are not directly involved in the process, but are involved in processes affected by changes to your process., who will then investigate and determine the necessary actions to take to resolve any issues so the treatment can be signed off as compliant.

Notifications

The table describes who receives notifications for risk and compliance actions and how they can be addressed.

Type of notification Who gets notified? Steps to address
Treatment Signoff
  • Person responsible for signing off that a risk treatment is in place and operational.
  • Nominated Risk Owner if the risk sign-off is overdue or marked as non-compliant.
  • Risk Manager when risk sign-offs associated with the portfolios you manage are overdue or marked as non-compliant.
  • If no Risk Owner has been nominated, Risk Portfolio Managers are default owners and will get these notifications.
  • Risk Escalation stakeholder of a certain risk score range and the treatment sign-offs associated with that risk score are overdue or have been marked as non-compliant.
  • Promasters for assigned signoffs to them and sign-offs assigned to other users that are overdue or marked as non-compliant.

Tip: Promasters and Risk Managers can enable the Admin > Risks > Other Configurations > Enable treatment signoff reminder emails (Default: Off)' setting to enable email reminders for treatment sign-offs. A mobile friendly page is available from the email for signing off the treatment.

Go to My Dashboard > My Risks > Signoffs due in <choose from the drop-down list> and select the required option as described below.

  • Click View Process to see the process details associated with a treatment: Process.
  • Click Sign off to confirm that a treatment has been applied or that a process step (which is the treatment) is both operational and effective.
  • Click Action to indicate that you are currently working on the treatment sign-off. The status will change to Under Action so other sign-off stakeholders are aware not to sign off the treatment. The comment/note you add displays when hovering over Users.
  • Click Non-compliant if the treatment is not in place, has not occurred, is ineffective, or if the process associated with the risk has changed and you need to investigate the impact of this change further before accepting it.
  • Click Sign off for all to confirm that an escalated treatment sign-off is valid for ALL users.

Note: This will complete the risk sign-off for all users. This option is only available to the Risk Manager, Risk Owner, Escalation stakeholders, Risk Portfolio Manager A user responsible for assigning incidents for investigations, approving actions plans, and closing risk and compliance items for a portfolio. and Promasters. Enter a sign-off comment and attach documented evidence that the treatment is in place, if required.

Treatment Changes to Review

  • Risk Owners are required to review any changes to activities that are linked to a risk treatment.
  • If no Risk Owner is assigned then it defaults to the Risk Portfolio Manager(s) to review the treatment change.

Go to My Dashboard > My Risks > Treatment Changes to Review and select the required option as described below.

  • Click Sign off to indicate that you have assessed the impact of the process change and have made any necessary changes to the risk's control effectiveness as a result of the change.
  • Click Non-compliant if a process change renders the treatment ineffective. You may need to contact the Process Owners regarding the process change, or create a new treatment before signing off the treatment change.

Risks to Assess

If a control effectiveness is not rated when the risk is created, then the Risk Owner and Risk Portfolio Manager must assess the risk.
  • Risk Portfolio Manager or Risk Owner of a new risk.
  • Risk Portfolio Manager or Risk Owner, if the risk's residual score has not been assessed.

Go to My Dashboard > My Risks > Risks to Assessand select the required option as described below.

  • Click View on a new risk notification to navigate to the risk.
  • Click Seen it to clear a new risk notification.
  • Click Action for residual rating required notifications to navigate to a risk and assign a control effectiveness score or the residual likelihood and severity if you have manual scoring enabled.

Risk Reviews

Depending on the risk score, risks may need to be reviewed periodically by the Risk Owner and Risk Portfolio Manager.

 Risk Portfolio Manager or Risk Owner, if the risk is due to be reviewed or the review is overdue.

Go to My Dashboard > My Risks > Risk Reviews due in <choose from the drop-down list>and select the required option as described below.

  • Click View to see the risk to be reviewed.
  • Click Review when you have reviewed the risk and verified that the risk and treatment details are accurate. The risk due date will be reset to the date for the next risk review cycle.