Advanced Risk Scores Recalculating

[Erik Nelson]

Hello!

I'm trying to figure out what script/job is recalculating or updating scores on Advanced Risk Assessments for the same Entity. My example record came up because the score was updated after the approval was sent to a lower residual score, which caused it to look like the approval went to the wrong place. Here's the info I do have:

1) There are 5 total Risk Assessments for the Entity, all created around the same time on 07/02

2) There were updates to Residual risk and/or Control effectiveness done by "System" on three of those records at approximately the same time on 07/03 (within a few seconds). This is also about 24 hours after they were created.

3) The three records that were updated have overlapping Controls assigned across the two that were not updated

4) There wasn't any logged/audited update that indicates a change was made to any of the records to trigger any sort of recalculation

I don't know for sure that this isn't tied to a roll-up, but I'm not 100% certain on that functionality in Advanced Risk. My intuition wants to say there's some type of scheduled job that's taking an action, but pretty much everything I'm seeing related to Risk seems to be running either on-demand or every 5 minutes. Anyone have any pointers on where I should be checking to find the exact thing making the update?

Thanks,

Erik

[Vikram Reddy]

Hi @Erik Nelson,

Almost certainly by design, and it's the GRC indicator nightly run scheduled job doing it, not a rogue script. That job ships OOTB but inactive, so plenty of admins don't realize it's live once someone turns it on. It fires nightly, checks every Indicator whose Next run time has hit, generates an Indicator Task for it, and when that task closes it writes back to the linked Control's compliance and effectiveness status. If the Risk Assessment Methodology behind these records has an Automated Factor mapped to that Control's effectiveness or "connected control health," the factor recalculates on its own interval and rewrites Residual risk on any Risk Assessment referencing that Control, no manual touch, and no obvious audit entry on the assessment itself because the real trigger happened upstream on the Control and Indicator records, not the assessment.

That lines up with what you're describing: three of five assessments moved because they share Controls with active Indicators attached, the other two didn't share those Controls, the change landed about 24 hours after creation because the job runs nightly, and it shows as System because it's a scheduled job, not a user edit.

Where I'd dig next:

• Check whether GRC indicator nightly run is active in the scheduled jobs list, and pull its execution log around 07/03
• Look at the Indicator and Indicator Task records tied to the three shared Controls, specifically Last run and Closed dates near that timestamp
• Check the Control records themselves for a compliance or effectiveness status change on 07/03, that's the actual trigger, not the Risk Assessment record
• Review the Risk Assessment Methodology config for these assessments, specifically whether Residual or Control effectiveness uses an Automated Factor pointed at control health, and what interval it recalculates on

If the factor turns out to be recalculating more aggressively than you want, or you just don't want indicator closures silently touching residual scores mid-approval, that's a configuration fix: switch the factor to manual, adjust the indicator schedule, or add a condition so it skips recalculation while an assessment is in an active approval state.

Thank you,
Vikram Karety
Octigo Solutions INC