Privacy Smart Assessment Questions

[Mathew Hillyard]

I've been reviewing the Privacy documentation and have taken the latest Privacy Essentials training on ServiceNow University. It seems with the update to Smart Assessment Engine and Privacy V3 templates the configuration is stuck between old and new. I have a few questions that I am unable to find the answers to:

1. How are Controls and Risks attached to a Privacy Screening Assessment once it is completed? I can see this happening when running the OOTB V3 Screening Assessment but cannot find any correlation between the Controls and Risks associated to an Entity, and indeed on the Outcomes section of the Assessment record it states "These control objectives & risk statements are added based on the responses to the assessment. These will be associated to the processing activity after the assessment is closed complete." That's great, but HOW are they associated? if it is based on the response to questions how and where is this configured? The documentation talks about associating it in "Assessment Templates" but V3 templates are not visible here because this module only refers to classic assessments, not smart assessments.
2. If I copy one of the OOTB V3 Assessments to create my own version (in my case the V3 screening assessment) within Assessment Workspace and publish it, then pick an Entity that does not have a screening assessment associated to it and send the initial screening assessment, once completed a Processing Activity is not created, but it is created with the OOTB V3 Screening Assessment. Any ideas why? I am not sure whether there is an issue with demo data but on a few occasions it doesn't even create the screening assessment with my copied assessment template.
3. Is it possible for a user to take the assessment outside of Employee Center? The documentation mentions Self-service > My assessments and surveys but I suspect this is for classic assessments only and not Smart Assessments

Thanks!
Mat

[Mathew Hillyard · Accepted solution]

After spending a long time digging through tables and Flow Designer, these are the answers.

1. The Control Objectives have been manually-added into the Assessment Automation Rules that begin "Map control objective..." Only one of them actually maps a Control to a question response (the criminal offenses automation). The other two map the Control Objectives to the Processing Activity and to the Privacy Task (assessment) if the user has responded Yes to the PII question.
2. This is down to the activated Automation Rules in the Automations section of the Assessment Template. This governs many aspects, such as mapping question responses to Information Objects, mapping Controls, and creating the Processing Activity. When you copy an Assessment Template the Automation Rules are in Draft and need to be Activated to apply. This is all part of Post Assessment Automations: https://www.servicenow.com/docs/bundle/zurich-governance-risk-compliance/page/product/assessment-eng...
3. The assessment can only be taken in Employee Center. It is not visible in the core platform as the Smart Assessment Engine is using the Next Experience.