Using Transcend Risk Scoring with Assessments

Introduction

Organizations of any size need a consistent and efficient way to collect information about their risk profile. This information is often gathered using Assessments. The Risk Scoring feature allows companies to define customizable Risk Frameworks that automatically tag responses with risk scores for configured risk categories.

Definitions:

1. Risk Framework: A customizable and reusable definition of risk, that includes:

• Risk levels (e.g., "low, medium, high").
• A matrix of values mapping combinations like "unlikely" and "severe" to risk levels (e.g., "medium").
• Categories the framework applies to (e.g., "data breach," "reidentification," "data loss").

2. Risk Levels: Values to understand risk, such as "low, medium, high" or numeric values like "1, 2, 3".
3. Risk Matrix: A table mapping combinations of values (e.g., "severity" and "likelihood") to an overall risk level.

Creating a Risk Framework

1. Navigate to the Risk Frameworks tab and click New Risk Framework.
2. In the modal, provide a title and description for the framework.

3. Define Risk Levels:

• Add levels such as "low," "medium," and "high" or map them to numeric values.

4. (Optional) Enable Risk Matrix:

• Customize the matrix headers and map combinations of values to a single risk level.

5. Define Risk Categories:

• Add categories such as "risk of data loss," "risk of reidentification," and "risk of data breaches."

6. Click Save to save the framework. It can now be used in your Assessment Templates.

Mapping Assessment Responses to Risk Scores

To automatically map Assessment responses to risk scores:

1. Navigate to the Templates tab and open the desired template.
2. Find the question(s) where you want to apply risk scoring.
3. Under Advanced Settings, toggle Risk Scoring on.

4. Configure:

• Select the Risk Framework and the Risk Category this question relates to.

5. (Optional) Use a matrix to calculate risk based on two values.

You can use multiple frameworks and categories in a single template to accommodate various risk scoring needs.

Reviewing Assessments and Overriding Risk Scores

After setting up frameworks and logic, collect Assessment responses by following the process outlined in Creating, Assigning, and Reviewing Assessments.

1. Once a response is In Review, click View Response to see the automatically assigned risk scores.

2. Override or add risk scores:

• To override: Click the dropdown next to a question and select a new category or score.
• To add a score: Click Configure, then select the appropriate framework, category, and score.

Edits are allowed while the Assessment is In Review. Once it’s Approved or Rejected, risk scores are saved and locked.