Push Risk and Control Templates to Entities via Spreadsheet Upload

A Risk and Control Template housed in the library can be "pushed" out or imported to several processes and/or organizations at once through the use of a spreadsheet upload. This can expedite the importation of Risk Control Matrices and will be particularly useful for organizations with the same processes operating across multiple business units.

Access the Risk Matrix Templates.
1. Select the Default GRC context from the context menu.
2. Click the GRC Register tab.
3. Select Risk Matrix Templates from the Library group.
Click the Risk Matrix Template Group containing the template you wish to push to processes or organizations.
Click Push to Processes.
Click Download.
Click Risk Control Matrix Template Push Download.
Within the search results screen, click the Action Menu and click Execute.

(Optional) Click the

Action Menu and utilize the search functionality to modify your selection and focus your results.

Notes:

See Utilize List Searches and Utilize Saved List Searches for additional information.
Fields beginning with "REQ" are required to process the spreadsheet and must be included in the search.
Fields beginning with "PUSH" should be included based on the type of push.

Within the resulting search results screen, click the Action Menu, and click Download List to download the search results to a spreadsheet.
Place an X in the "PUSH" column for the select organization or process.
Click Download.
Note: Select the Download Spreadsheet with Existing Users Data check box to include the existing user information in the spreadsheet.
Populate the Excel upload spreadsheet (see Spreadsheet Population Notes below), and save the file to your hard drive.
Return to the Governance Portal and click Browse on the Population screen.
Locate the modified upload spreadsheet.
Click Process Spreadsheet.
Check the Processing Results box for any errors that may have occurred during import. If an error occurs the spreadsheet processing will fail, no records will be created. Return to the Excel template, and make necessary modifications as directed through the Processing Results box.

Spreadsheet Population and Validation Notes

Spreadsheet Population Notes

The Organization and Process model must already exist. The organization and process model is downloaded to the template along with attributes of each model. The user can perform additional filtering if necessary, and then places an "x" next to each organizational unit and / or process to which they wish to push a given Risk Matrix template. The user can choose one of three ways to push the template as outlined in the Column Headings - Entries table below. This functionality allows users to quickly replicate standard objectives, risks, controls, risk event categories, and tests to processes and organizational units

Column Headings - Entries	Action
Select Columns	No entry: Columns selected by the user when creating the search and downloaded to the spreadsheet.
Process Name	No entry: Identifies the process to which a risk matrix template will be pushed. This field can be used to filter for a particular process.
PushUseCurrentItems	Optional: "x" is the only valid entry. Use this column when you are pushing new objectives, risks, and controls to pre-existing risk matrices. Placing an "x" in this field will push all new objectives, risks, and controls to selected processes, but ignore duplicate objectives, risks, and controls. Note: The "x" will only be recognized by the Governance Portal if a risk matrix for a particular process already exists. To create and push the risk matrix to a particular process where a risk matrix has not yet been created, use the Push RCM - Overwrite RCM.
PushUseNewItems	Optional: "x" is the only valid entry. Use this column when you are pushing new objectives, risks, and controls to pre-existing risk matrices. Placing an "x" in this field will push all new or duplicate objectives, risks, and controls to selected processes while retaining any existing objectives, risks, or controls (duplicate items are imported with a timestamp concatenated to the end of the name to identify duplication). Note: The "x" will only be recognized by the Governance Portal if a risk matrix for a particular process already exists. To create and push the risk matrix to a particular process where a risk matrix has not yet been created, use the Push RCM - Overwrite RCM.
PushOverwriteRCM	Optional: "x" is the only valid entry. Use this column when you wish to initially create risk matrices for particular process or completely overwrite existing risk matrices. Placing an "x" in this field will delete existing risk matrices from selected processes, and push all objectives, risks, and controls to the risk matrix associated with selected processes.
REQOrgUnitId	No entry: Organization unit id number automatically generated by the Governance Portal
REQProcId	No entry. Process id number automatically generated by the Governance Portal.

Template Notes	Action
Import Operation	The given risk matrix template will be pushed to all processes selected on the import template.
Maximum Rows	N/a
Spreadsheet Locking	To allow for filtering, the spreadsheet is not locked. However, actions should only be performed around processes downloaded from the Governance Portal. Do not add additional processes directly to the spreadsheet.

Validation Notes

Validation	Portal Reaction	Suggested Corrective Action
Rows are skipped.	All rows not containing an “x” are skipped. Rows containing an “x” in one of the Push fields are subject to other validation rules.	N/a – see other validation requirements.
Org Unit or Process does not exist in the Governance Portal (e.g. because user added the process or org. directly to the spreadsheet instead of utilizing the processes downloaded from the Governance Portal).	Entire import is rejected.	Download data from the Governance Portal to the spreadsheet.
Action fields contain values other than “x”.	Entire import is rejected.	Make sure that “x” is used in all action fields.
An “x” is marked in more than one column for a given process.	The Governance Portal will not know which operation to perform for the given process. Entire import is rejected	Verify that "x" is only contained in a single column per process. Select the appropriate operation for processes where more than one column contains an "x".