A pre-assessment is a quick, scored screening of a record in one of your registers. It tells you how much attention a supplier, IT system, business process, customer relationship or AI system needs. For most records, the screening, the treatments that close its gaps and a signed approval are enough evidence for an audit. Only records with high scores need a full risk assessment. That keeps the effort proportionate, with proof.
| Pre-assessment | What it assesses | Where to start it |
|---|---|---|
| Supplier Security Assessment | The supplier's inherent risk, security maturity, how dependent you are on it, and risk flags such as a missing data processing agreement or a recent incident. | Vendors: Assess on the row |
| IT System Security Assessment | The system's exposure and access, business impact and dependency, data and compliance, and security maturity (MFA, backup, patching, logging, access control). | IT Systems: Assess on the row |
| Operational Exposure Assessment (BIA) | How exposed a business process is if it is disrupted. See Business processes and BIA. | Business Processes: Business Impact on the row |
| Relationship exposure | What a customer relationship exposes you to: what you hold for the customer, what you can reach in their environment, what you have promised, and what rides on your service. It does not rate the customer itself. | Customers: Assess exposure on the row |
| AI Act Pre-Assessment | An AI system's regulatory exposure under the EU AI Act: 15 questions across 10 areas, plus indicator flags. | IT Systems: answer Is this AI?, then Start AI assessment |
You can also start any of them from Assessments: select New assessment, choose what to assess, select the record and select Start assessment.
Open Vendors, Systems & Processes > Assessments. The page lists every pre-assessment in the organisation with its type, risk score, risk level and date, and shows:
Select assessments to Print selected or Delete them. Deleting removes the answers, score and approval, but keeps the vendor, IT system, process or customer. It cannot be undone, except for AI Act pre-assessments, which go to the archive.
Customer assessments are only shown to users with access to customers.
Every pre-assessment opens as one report with four tabs: Answers, Result, Treatments and History. The Result tab shows the score, Why this score, and a Progress list with four steps. One highlighted button always shows the next thing to do.
Scores run from 0 to 100. For suppliers, IT systems, the BIA and customers, the bands are 0–24, 25–49, 50–74 and 75–100 (labelled Low, Medium, High and Critical; the BIA uses Resilient, Manageable, Exposed and Critical). The AI Act pre-assessment has its own five levels: Limited, Moderate, Elevated, High and Critical.
The relationship exposure report does not start a risk assessment itself; follow up the causes it names with treatments. The AI Act pre-assessment escalates through its IT system.
The approval records who approved, when, and the next review date, and adds an entry to the risk acceptance register. You can approve while treatments are still open. If the record has no owner or responsible person, Diri warns you that the risk is accepted with nobody recorded as accountable. See Risk acceptance.
To approve, you need permission to edit the record (the vendor, IT system, process or customer).
An approval is never removed without asking. If you change an answer, or a field on the record that the score reads, and the result changes, Diri shows Break a signature? with the score before and after. If you confirm, the signed version is kept in the assessment's history, the entry in the acceptance register is withdrawn, and the assessment must be approved again. If you keep it as it is, nothing is saved. The change, and who made it, is recorded.
Some assessments read other records: the BIA reads the vendors, IT systems, policies and treatments linked to the process, and the IT system assessment reads the processing activities linked to the system. If those change, the result shows Scored on records that have changed instead. The approval stays; save the assessment again to score it with the current records (Diri asks before it replaces the approval). A result in this state cannot be approved until it has been scored again.
A bulk import never breaks a signature: rows that would do so are held back, see Bulk import.
Select Withdraw approval, give a Reason and select Withdraw. The assessment data is kept, a withdrawal record is added to the audit trail, and the assessment can be approved again at any time. Withdrawals are listed under Signature withdrawal history.
The History tab shows earlier signed versions, approvals and withdrawals for the record. Signed versions retired by a later change are also listed on the Assessments page under Retired signed versions, with who signed, the score and the justification. Opening one shows the version as it was signed, read-only.
Use Print report on an approved assessment, or Print / Save as PDF on the Assessments page, for a printable report.
Pre-assessment treatments come from a central catalogue of best-practice measures, one for each question and answer that leaves a gap.
On the Treatments page, the Pre-assessments filter shows these treatments, where each is applied and how far the work has come. In the treatment's own form, Applied in assessments lists every record that uses it, where you can change several at once. Treatments used by pre-assessments are not offered in risk assessment pickers, and their deadlines are not shown on the annual wheel. See Treatments.
When an IT system is classified as an AI system (Is this an AI system? on the IT system, or Is this AI? in the IT system list), it needs an AI Act pre-assessment in addition to the security assessment.
The pre-assessment decides whether AI Act obligations apply. Whether they are met is assessed in the AI Act compliance assessment, part of the risk assessment of the system, which covers use-case severity, human oversight, fundamental rights, technical and provider compliance, and transparency and governance.