Review Page

This feature is available to users with the roles of Reviewer or Admin Reviewer. Other roles are unable to see the Review button on the Insights by Law page. With this feature, reviewers can quickly access and manage the following:

• Summary and status of the controls related to the selected law or standard
• The responses provided to the framework questions
• Any attached accountability mechanisms
• Generated tasks with the corresponding task assignee

Following are some guidelines on how to move around the Reviewer View:

• From the Program Overview page, click the Review (1) button. You can also choose a standard name (2) and then click the Review (3) button on the Insights by Law page.
  
  
  NOTE: Use the breadcrumb trail to return to the Insights by Law or Program Overview easily.
  
  
• Click the Download button to export the downloadable sources or data. For more information, go to Generating Reports.
  
  
• Click any pillar on the Framework badge to sort the controls related to the law or standard according to their Framework pillar category.
  
  
  
• Click each count of controls. This will display the controls list accordingly: controls met, all controls evaluated, all controls requiring improvement, and total controls. 
  
  
  You can select a framework pillar above to see the number of controls that have been evaluated for that pillar.
  
  
• The column headers essentially describe the type of data found in that column. 
  
  
• Pillar - Defines which Build, Implement, and Demonstrate sector of the framework the control falls under.
• Control Number - These are unique identifiers used to track both common and external controls.
• Framework - The indicator to which TrustArc’s framework the control belongs.
• Control Description - The specific guidelines of the standard’s requirement.
• Questions - The number of questions that correspond to the control.
• Effectiveness Score - Indicates how the selected laws and standards are adhered to versus the three pillars of the TrustArc Privacy and Data Governance Accountability Framework.
• Status - Indicates the control’s current status.
• Activity - Shows the most recent activity conducted for that control.
• You can examine each control and question and the data related to it by using the expand icon (1) or the Expand All/Collapse All button (2).
  
  
• On the bottom of the page, you can navigate between the pages of the controls and questions, or view several controls at once by 25, 50, 75, 100, or 200. PrivacyCentral will remember your row selection when you return.
  
   
   

Controls Evaluation and Approval

Use the following functions when evaluating the control and approval process:

• Navigate through the questions and controls based on their status: All, Active, Current, Inactive, or Action Required.
  
  
• Use the Search and Filters to find and display information about a specific control. Adjust display based on its Control Number, Framework Category, Control Status, Task Status, and Labels. Once the filters are selected, you can choose to Clear or Apply Filters.
  
  NOTE: A control number specifies whether a control is a framework control (FC), a common control (COC), or a unique external control (EC) for the law or standard. ‘FC’ means that the law’s or standard’s requirement or citation is directly mapped to TrustArc’s Framework. ‘COC’ covers multiple controls in a single standard or across multiple standards. Controls with multiple citations are the result of leveraging common controls.
• View the specific citations in the law or standard where the selected control was derived. 
  
  
• One or more controls and questions can be sent to respondents at the same time. Check the corresponding box (1) and then press the Send Questions button (2).
  
  
• Type any note you wish to leave for the task. This will be saved automatically, as seen in the green popup message.
  
  
• All controls of the law or standard are viewed in the Review page. In cases where control is deemed not applicable, you can still view the grayed-out information of the control.
  
  
• Click on Add Comment to add any comments to aid in your review on the not applicable control.
  
  
• Manual tasks can be added by either clicking on the Add Manual Task from the Manual Tasks widget or the Create Manual Task button from expanding any control.
  
  Click the task name (1), or scroll right and click the Edit icon (2) to view the complete details of a generated or manual task including the last modified date of task and last auto-save (3) for each individual question.
  
  
  
  The Edit Task pop-up displays the most recent activity of task details, including updating any information about the task.
  
  You can also add or read a comment thread to the task by clicking the Comments button.
  
  
  
  An email will be sent to the specific user who commented on the task.
  
  
  
  You can also click the three-dot menu to reply, edit, or mark as unread to a comment from the task modal.
  
  
• To change the task assignee, hover over the Assignees column and click the pencil icon (1) to open the Assign Task window. Select any user to assign (2) the task to and add a brief message. Then, click Assign (3).
  
  
  NOTE: Reviewers can only reassign questions that have a Not Reviewed or Task Outstanding status.
• To re-assign a question to another individual within your organization or to non-system external users, you can click the Send to Respondent button within a question, or send multiple questions at a time by clicking the Send Questions button.
  
  
  
  • Reassigning to another individual within your organization
    
    When re-assigned, a notification will alert the person to whom the question was assigned that they have a question to answer or a task to complete. If you access the notification directly from the platform alerts, you will be redirected to the question window or task.
    
    
    
    
    
    When the assigned user receives the summary task email (at the frequency chosen), the tasks are clickable. This enables you to take action right from the email.
    
    
  • Reassigning to non-system external users
    
    When reassigning questions or tasks to non-system external users. type in  their email addresses under the Respondents field when sending questions
    
    
    They will receive an email from TrustArc with a button redirecting them to the specific question or/task assigned to them.
    
    
    To open the assigned question or/task, they must provide their email and an access code included in the email.
    
    
    When the external user is assigned a question, they can answer the question and add attachments/URLs.
     
    
    When the external user is assigned a task, they can answer the question, add attachments/URLs, and add comments.
    
    
    NOTE: The link in the email expires after the law is approved or when the email address is removed from the respondents list.
• When an Accountability Mechanism is attached to the control, a detailed discussion of its capabilities can be found in the Policy & Standards Library section.
• The Reviewer can add, select all, or deselect an Accountability Mechanism from the Review page. Click the pencil icon to take action of that AM.
  
  
• Reviewers are unable to change accountability mechanisms for controls that are on Evaluated and Approved status. Reviewers have the authority to add or remove any evidence from any control, except the Not Applicable and Approved controls. To change an Approved control, first set it to Not Approved.
  
  
• To edit an Accountability Mechanism, click the title name.
  
  
   
• If the control or the task  is in the Approved state, you can still view the details of the task by clicking the accordion, task name, or the comments link.
  
  
  
  
  You can add Note on any control at any state other than the Approved status. To add a note to an Approved control, you would first need to move back to the Not Approved state.
• Reviewers can override the system-generated control effectiveness score.

1. Hover over the Effectiveness Score column, then click on the Edit icon beside the control effectiveness score.
   
   
2. Select a percentage and add a comment to support the score adjustment. Then, click the Save button.
   
   
3. The overridden score will automatically replace the system-generated score. You can hover-over the pencil icon to see the adjustment details.
   
   

• Reviewers can approve all active controls within a law or standard by clicking the Approve All Controls button, then the Confirm button in the pop-up window. This does not include controls that are not applicable or with exceptions.
  
  

A pop-up window displays showing if the approval was successful or partially successful.

1. If successful, this is the popup dialog box.
   
   
2. If partially successful, the popup shows all the controls not answered.
   
   

NOTE: The controls will be “approved with exceptions” if the task is still open. This means the CE score will not be changed for that specific control.

• Once all controls are approved, click the Approve Law button at the top of the Review page and select Continue in the pop-up to approve the law/standard. 
  
  
  

This automatically updates the last activity details (1). Since users with Reviewer or Admin Reviewer access can revalidate the questions, this must be done within the timeframe specified. Answers are typically revalidated on a quarterly or annual basis. To revalidate a law or standard, it must first be Approved.

Click Unapprove Law (2) to revert your changes.
 

Revalidation

Use the following features throughout the revalidation process:

1. The law or standard is eligible for revalidation once the days until the revalidation timeframe are met. The reviewer can go to the Program Overview page and click Revalidate for the specific law or standard.
   
   
2. Click the Revalidate button when a prompt appears after clicking the revalidation link.
   
   

NOTE: Clicking Revalidate will reset the law or standard. This will reset the control status into Not Answered or Partially Met. The control effectiveness and progress will also reset to its initial values.

3. During revalidation, you will start answering the questions beginning with the first question from the Program Overview. Select an answer and add evidence to a question.
    
   1. If you want to change a response and the question is linked to a common control, a warning icon displays before changing a response. A pop-up window appears, allowing you to select a response from an existing common response (if one exists) or switch to an independent response. Click the Update Current Law option or Update Common Response buttons, as appropriate.
      
      
      1. Click the Update Current Law option if you want to apply the change and convert the common response into an independent response.
         
         
          
      2. Click the Review Responses button to see the responses across shared controls of applicable laws.
         
         
      3. Click the Update Common Response option if you want to select a response from an existing common response.
          
   2. You can add evidence to support your responses by adding or using existing Accountability Mechanisms (1) , adding URLs (2) , or uploading documents/policies (3).
      
      
4. You can attach a new or existing Accountability Mechanism to Yes responses. 
   1. To add a new Accountability Mechanism, select Add New Policy and provide the required information. 
   2. To use an existing Accountability Mechanism, select Use Existing Policy and select from the list. 
      
      
      A pop-up will display informing that selecting this AM will link it to all associated laws/standards. Select Yes, link to all laws and standards to proceed.
      
      
5. You may also edit  an existing Accountability Mechanism, by clicking the AM’s edit icon. This will open the Edit Accountability Mechanism modal where you can also add URLs or upload documents/policies  just select the applicable file when answering the questions/controls. Take note that duplicate URLs will not be saved by the system. A message saying: URL needs to be unique displays, and the Add URL button to save the URL will be disabled.
   
   
6. If you wish to re-assign a question/control to another respondent, click Reassign at the top-right corner of the question/control. You have the option to notify the newly assigned respondent by sending an email immediately. You may also clear the answer for the question when reassigning.
   
   
7. The Review page displays the status of revalidation for the law or standard in real-time.
   
   
8. You can check on the status of the questions/controls at the top part of the page, or by going to PrivacyCentral >  Program Overview then clicking the Review button for the specific assurance program. 

NOTE: 100% Progress does not mean that the assessment is complete. This  means that the customer has already completed answering the questions/controls but there are still Outstanding Tasks.