¶ Why complete and sign?
Complete & sign is the final step of the risk assessment. It is a quality assurance and risk acceptance step. By signing, the decision-maker confirms that:
- The treatments are sufficiently described (quality).
- The treatments are within a reasonable cost (cost).
- The risk is acceptable based on the risk assessment and the treatment plan (benefit).
- The treatments will be implemented, by whom and by when (responsibility and time frame).
- The residual risk is accepted (risk ownership).
Residual risk is the risk that the organisation's management deliberately accepts. That is why a decision-maker at the right level should sign, for example a system owner or risk owner. The decision is recorded in Diri and in the risk acceptance register.
¶ What the step shows
- Accepted cost and risk picture: The risk matrix and cost for the plan you are about to accept.
- Treatment list: The planned and implemented treatments needed to reach the planned risk level shown in the matrix.
- Risk acceptance: The signing section, with the current signature, if any.
¶ Signing the treatment plan
- Open step 5 on the risk assessment dashboard.
- Review the risk picture and the treatment list. Diri tells you how many risks the signature accepts, and how many of them remain above your organisation's acceptance threshold.
- Click Sign treatment plan. The dialog Sign and accept risk and treatment plan opens.
- Confirm I approve the treatment plan for this assessment. and I accept the residual risk that remains once the plan is in place.
- Write a Justification. It is required when risk remains above the acceptance threshold, and optional otherwise.
- Click Confirm and sign.
The step then shows Signed by, Signed date and Treatment plan valid until. The validity is set by your organisation's revision time, and decides when the assessment must be reviewed again. Use Download PDF to save a copy of the signed plan.
If the decision-maker is someone else, click Send for signing instead. The person responsible for the assessment receives a task and a notification asking them to sign.
Signing again later supersedes the earlier signature; it does not replace it. Earlier signatures are kept in the assessment's history.
Read more about signing requests, review periods and expired reviews in Signing and review, and about thresholds and the acceptance register in Risk acceptance.
¶ Revision time
Administrators set the revision time in Settings, in the risk assessment settings of each module: the length of time before a signed risk assessment needs to be reassessed. Diri notifies the owner when a review is approaching and when it has expired. Users choose which notifications they receive in My Account.
