The upcoming version of ARIS Risk & Compliance Manager will introduce an additional escalation option for "not effective" tested controls.
Currently, the test workflow is tightly related to the deficiency module. If the result of a test case is set to "Control not effective" the test reviewer can set the deficiency status to "Yes". This results in a deficiency being created. Alternatively, the test reviewer can set the deficiency status to "No" which, of course, leads to no deficiency being created.
In several customer projects, the test workflow has been modified by replacing deficiency creation with issue creation.
The basic idea of both concepts is to define an appropriate measure for a test case with the status "Control not effective".
In the upcoming version of ARIS Risk & Compliance Manager, we merge both ideas into a single approach.
The reviewer of a test case that was tested and found to be not effective will be able to decide if a deficiency, an issue, or none of the above will be created. As you can see, test and issue management workflows are strongly connected.
The integration of the Issue management workflow into the Test management workflow is a step toward interlinking our different ARIS Risk & Compliance Manager modules and to improving the ARIS GRC solution. All this results in setting up an efficient internal control system including an additional escalation possibility.
I hope I was able to awake your interest with this short announcement of one of the enhancements in our upcoming ARIS Risk & Compliance Manager version.
This is very interesting thanks Carmen, one of our current user groups has opted not to use Defeciency Management but to raise issues or recommendations in the event of 'non-effective' test cases. We have found this to work quite well, but it can be confusing to still have the Defeciency field and associated drop dowm menu available in the test case, so we would prefer to have an option to blank it out or select a default value if configurable. Accordingly, I will be waiting with interest to see what changes the upgrade will bring us.
In reply to Hi there. I went through the by claudiobr
Mr. Moody,
it seems we have an opposite problem in the combination Testing Management <> Defiency Management. This could answer your question?
in our case, the test reviewer does not see the dropdown Deficiency field in the testcase (he can perform all test reveiwing actions, except the deficiency status is simply not visible)... and unfortunately... we would like to "activate" this Defiency status field in the testcase.
We're trying around to understand WHY we do not see this. Our latest guess is the fact that no deficiency managers were defined in ARIS Business Designer for these specific testcases.
This may be a workaround to solve your problem - if you would have any feedback on this idea we're happy to hear this as well
Thanks,
