How to create Control Tests in GRC

tena1
Tera Contributor

How to create COntrol Tests in GRC.

I do not see the IT GRC -> Control Tests as given in the Madrid Docs.

I believe Attestations are created to check the Control Design Effectiveness.

How to check the Control Effectiveness in GRC

1 ACCEPTED SOLUTION

Shiva Thomas
Kilo Sage

Hi Tena,

The Automated Tests you are looking for are located in "Automated Test Framework > Tests". You'll obviously need to be at least at Madrid version.

find_real_file.png

Another relevant link: Is anyone using Automated Test Framework in GRC?

Attestations are freely customizable questionnaires that can be used to to trigger events for your Controls, but out-of-the-box they are intended mostly for manual review: After reviewing the Assessment, the actions are taken manually by the Control's Owner. Only some question type can trigger a simple compliant/non-compliant status on the Control. Since non-admins can edit/create Attestations, any more advanced scripted automation logic could be broken by modification of the Attestation template.

To affect the Status of a Control, you can also you Indicator tasks (manual or scripted) or a simpler but custom one button attestation approach.

The effectiveness can be mesured by looking the impact of the Control's Status on the Calculated Scores of a Risk linked to your Control.


Best regards from Switzerland
Shiva :¬,

If this reply assisted you, please consider marking it 👍Helpful or Correct.
This enables other customers to learn from your thread.

View solution in original post

2 REPLIES 2

Shiva Thomas
Kilo Sage

Hi Tena,

The Automated Tests you are looking for are located in "Automated Test Framework > Tests". You'll obviously need to be at least at Madrid version.

find_real_file.png

Another relevant link: Is anyone using Automated Test Framework in GRC?

Attestations are freely customizable questionnaires that can be used to to trigger events for your Controls, but out-of-the-box they are intended mostly for manual review: After reviewing the Assessment, the actions are taken manually by the Control's Owner. Only some question type can trigger a simple compliant/non-compliant status on the Control. Since non-admins can edit/create Attestations, any more advanced scripted automation logic could be broken by modification of the Attestation template.

To affect the Status of a Control, you can also you Indicator tasks (manual or scripted) or a simpler but custom one button attestation approach.

The effectiveness can be mesured by looking the impact of the Control's Status on the Calculated Scores of a Risk linked to your Control.


Best regards from Switzerland
Shiva :¬,

If this reply assisted you, please consider marking it 👍Helpful or Correct.
This enables other customers to learn from your thread.