Control Vs Issue

[Senthil Kumar 1]

I have noticed this behaviour - Could you please advise why we having this logic in place? 

If I add a issue in the control and 

if the issue's field "Control/Risk" is blank
then there is no change to the control status
else
the control become ineffective

Means if the added issue already having control or risk associated with then the control bcom ineffective

[yashkamde]

Hello @Senthil Kumar 1 ,

This is expected ootb GRC behavior, not a bug. When an Issue is created without a Control/Risk, it's treated as a general issue, so there's no basis to change control status. But once an Issue is explicitly linked to a Control/Risk, it's treated as documented evidence of a control failure, so the platform automatically flips that control's effectiveness which is non-compliant.

Refer this :
How is the GRC issue related to GRC indicators 

If my response helped mark as helpful and accept the solution.

[Senthil Kumar 1]

Thanks for your response. Really appreciate. 

In my case, when the Control/Risk is added then the control effectiveness not changing, only changing to ineffective when there is existing control/risk added to that issue

[TharaS657398130 · Accepted solution]

Hello,

This behavior is related to how the OOTB GRC logic evaluates the relationship between Issue and Control. The control effectiveness update happens when the Issue is considered as evidence of a control failure. If the Issue is already linked to a Control/Risk at the time of creation or before the evaluation runs, the system identifies that relationship and updates the Control status accordingly.

However, if the Control/Risk is added later and the effectiveness is not changing, it may be because the related indicator/evaluation process is not getting triggered automatically. You can check whether the control evaluation, indicator, or scheduled job responsible for updating control effectiveness has run after adding the relationship.

Also verify the Issue state, Issue type, and the Control/Risk relationship, as only certain Issue conditions trigger the control effectiveness update OOTB. If needed, you can manually trigger the evaluation or review the business rules related to Issue-Control relationships.