Getting Started With Risk Assessments

This page walks you through a Risk Assessment from start to finish: who's involved, how an assessment moves through its statuses, how to complete each step, and who is notified along the way.

Every assessment you can access is listed on the Assessments page under Risk Management, where you can search, filter, and track each one's status and progress.

Roles

Use this table to see what each role is for, and whether the person needs a DataGrail account. To assign roles, see Users & Roles.

Role	Has a DataGrail account?	What it does
Super Admin	Yes	Has full access to every assessment and can take any action.
Risk Monitor Admin	Yes	Runs the Risk Assessments program: sees every risk assessment, manages templates and settings, and can step in on any assessment.
Assessment Creator	Yes	Starts assessments and manages the ones they own, including approving their own work.
Assessment Requester	Yes	Starts and manages assessments like a Creator, but can never approve them or choose the approver. Use it when the people who request assessments must stay separate from the people who sign off on them.
Assessment Contributor	Yes	Fills in and submits only the assessments they were added to. DataGrail grants this role automatically when you add a user as a Contributor.
External Contributor	No	Fills in one assessment through an emailed link that is valid for 7 days.

Approvers, Assignees, and Role Access

• Approver and Assignee aren't roles. An Approver is the DataGrail user set to sign off on one assessment. An Assignee is someone already on the assessment who's given a section or question.
• Roles add together. For example, an Assessment Requester who is also an Assessment Creator can approve.
• Own means the user created the assessment. Belong to means you added them as a Contributor. The Who Can Do This tables in each step use these terms.
• Simplified view: Users whose only roles are Assessment Creator, Assessment Requester, or Assessment Contributor see just their assessments, without the rest of DataGrail.

Steps

An assessment moves through six steps, from Create to Wrap-Up. Each box is a step, grouped by the assessment's status, and each arrow shows what changes the status. Dashed lines are optional paths:

Create

Every assessment is built from a template, which sets its sections and questions. DataGrail includes a library of prebuilt templates for common activities, such as DPIAs, AI risk assessments, and checks for whether a DPIA or PIA is needed. You can browse them on the Templates tab of the Assessments page. If none of them fit, you can build a custom template.

Who Can Do This

Action	Super Admin	Risk Monitor Admin	Assessment Creator	Assessment Requester	Assessment Contributor	External Contributor
See assessments	All	All risk assessments	Own or belong to	Own or belong to	Belong to	Only the assessment in their link
Create an assessment	Yes	Yes	Yes	Yes	No	No
Edit templates	Yes	Yes	No, can choose a template	No, can choose a template	No	No

Follow these steps to create an assessment:

1. On the Assessments page, select Create New Assessment.
2. Enter an Assessment Name.
3. Choose the Template that best fits the risk or activity you're documenting.
4. Select the Systems the assessment covers.
5. Optionally, add a Processing Activity and a Due Date, and select Regular renewal required if the assessment needs to be renewed on a schedule.
6. Select Create Assessment.

The user who creates the assessment becomes its owner. If the template has a default approver, they're notified right away.

Assessment Identifiers

Each assessment gets a permanent identifier in the format RA-N (for example, RA-42), shown below its name. Identifiers never change, even if you rename the assessment, and each new version gets its own. Use them to tell apart assessments with similar names, search the assessments table, or go straight to an assessment by URL (for example, /risk/assessments/RA-42-...).

Once the assessment is created, it's important to add assessment context.

Assessment Context

Assessment context is information that applies only to this assessment, such as a project description and supporting documents. Vera, DataGrail's AI assistant, uses it to suggest answers to the assessment's questions, which you review before accepting. The more context you add, the more accurate those suggestions are. You add it in the Assessment Context panel on the assessment's Overview tab.

Follow these steps to add context:

1. Open the assessment and select the Overview tab.
2. In Additional Context, describe priorities, constraints, or other details specific to the assessment, such as cross-border data transfers or children's data. Your input saves automatically as you type.
3. In Supporting Documentation, select Choose a File or drag and drop documents such as PRDs, functional requirements, privacy notices, or terms of service. Each file goes through a virus scan and vectorization step before Vera can use it, and a status indicator shows its progress.
4. Optionally, select Select an Assessment to link a previously approved assessment as a reference. Vera lists the ones it drew on under Linked Assessment Sources on each suggestion.

You can upload .pdf, .docx, .xls, and .xlsx files, images (.jpg, .jpeg, .png, .gif, and .webp), and text files, up to 10 MB each.

Invite

Next, add the people who will help fill in the assessment, called Contributors, and choose who will sign it off, called the approver. You do both from the assessment's Overview tab while the assessment is Not Started or In Progress.

Who Can Do This

Action	Super Admin	Risk Monitor Admin	Assessment Creator	Assessment Requester	Assessment Contributor	External Contributor
Add Contributors and send a part back	Yes	Yes	Own	Own	No	No
Invite External Contributors	Yes	Yes	Own or belong to	Own or belong to	No	No

The people you add to an assessment each play one of these parts:

Part	What they do	How they're added
Contributor	Fills in answers and submits their part. Has a DataGrail account, like an internal system owner.	Invited from the Contributors panel. They log in to DataGrail and get the Assessment Contributor role if they don't already have access.
External Contributor	Fills in answers and submits their part without a DataGrail account, like a vendor contact.	Invited from the Contributors panel. They open the assessment from an emailed link that's valid for 7 days.
Approver	Reviews the assessment and approves it once every Contributor has submitted. Doesn't fill in answers, and there's only one per assessment.	The owner by default. To choose someone else, select Assign Approver in the Assignee panel and pick a DataGrail user with access. Users whose only assessment role is Assessment Requester can't be chosen.

Follow these steps to add a Contributor:

1. In the Contributors panel on the Overview tab, select Invite.
2. Select Contributor or External Contributor.
3. For a Contributor, search for or enter their email, then select Invite. If the email doesn't belong to a DataGrail user, you're taken to the External Contributor invite instead.
4. For an External Contributor, choose an existing contact or enter an email to create a new one, add an optional message, then select Send Invite.

To remove a Contributor who hasn't finished, or to resend an External Contributor's invite, select the ellipsis next to their name.

Fill In

To complete an assessment, fill in every required field in each section. Move between sections with the Back and Next buttons, or select a section in the left-hand menu. The current section is always highlighted. The first saved answer moves the assessment to In Progress.

Who Can Do This

Action	Super Admin	Risk Monitor Admin	Assessment Creator	Assessment Requester	Assessment Contributor	External Contributor
Fill in answers	Yes	Yes	Own or belong to	Own or belong to	Belong to	Yes, in their link
Assign sections or questions	Yes	Yes	Yes	Yes	Yes	No, but they can be assigned and can resolve

Each question has buttons to Generate Suggestion with Vera, Add Risk to the Risk Register, Attach Files, Assign it to someone, or Add Comment. Select My Assignments at the top to see only the questions assigned to you.

Comments

Comments let you and your Contributors discuss specific questions and sections without leaving the assessment. Select Add Comment on any question or section to open the Question Context panel, then write a comment, reply to one, or @-mention a user or Contributor to bring them in.

Replies, @-mentions, and new comments send a Collaboration notification.

Assignments

Assignments let you hand an individual question or section to the person best placed to answer it. Select Assign on any question or section to open the Assignments tab of the Question Context panel, choose a user or Contributor on the assessment, then select Assign Question.

You can assign the same item to more than one person, and each one becomes a separate assignment. The question or section then shows an assignment count, so everyone can see what's been delegated. Each assignment has a status:

Status	Meaning
Open	The assignment is active and waiting to be completed
Resolved	The assignee marked the assignment complete
Cancelled	The assignment was withdrawn

The assignee can select Resolve to mark it complete, or Unresolve to reopen it. The user who created the assignment, and Risk Monitor Admins, can Cancel it at any time. Creating, resolving, or cancelling an assignment sends a Collaboration notification.

Submit

When a Contributor finishes their part, they select Submit Assessment at the bottom of the assessment. A confirmation warns that they can't make changes after submitting, and lets them add an optional Message for Assessment Owner before they select Submit Assessment again.

Who Can Do This

Action	Super Admin	Risk Monitor Admin	Assessment Creator	Assessment Requester	Assessment Contributor	External Contributor
Submit their own part	If added as a Contributor	If added as a Contributor	If added as a Contributor	Yes, added automatically on assessments they create	Yes	Yes

Submitting doesn't approve the assessment. It updates that person's Contributor Status to show they've finished their part. When every Contributor has submitted, the assessment moves to Pending Approval and the approver is notified.

Approve

When every Contributor has submitted, select Approve Assessment in the bottom left corner of the assessment, then confirm. Once approved, the assessment is locked: its answers can't be changed and Contributors can't be added or removed until you create a new version. If you don't see the button, your role can't approve this assessment. Open Who Can Do This below to see who can.

Who Can Do This

Action	Super Admin	Risk Monitor Admin	Assessment Creator	Assessment Requester	Assessment Contributor	External Contributor
Approve	Yes	If no approver is set, or if they are the approver	Own, or belong to when no approver is set	No, unless they also hold a role that can approve	Only if set as the approver	No

After approval, select Download Assessment to download a copy.

Approval May Create a New Assessment

If the template includes a condition that automatically creates a follow-up assessment and that condition is met, you'll see a notice that approving will also create a new assessment.

Wrap-Up

To assess the same system again after approval, select Create New Version on the assessment's Overview tab. Enter a New Version Name, add an optional Due Date or select Regular renewal required, then select Create New Version. The new version is a separate assessment with its own identifier. External Contributor access ends once an assessment is approved.

Who Can Do This

Action	Super Admin	Risk Monitor Admin	Assessment Creator	Assessment Requester	Assessment Contributor	External Contributor
Create a new version or edit details	Yes	Yes	Own or belong to	Own or belong to	No	No
Cancel or reopen, if enabled	Yes	Yes	Own	Own	No	No

Cancelling and Reopening Assessments

If an assessment is no longer needed, for example because the engagement stalled or the initiative was de-scoped, you can cancel it instead of leaving it unfinished. Cancelling closes the assessment without approving it, and you can reopen it later. Cancelling must be enabled for your account, and you can't cancel an Approved assessment.

1. Select the ellipsis next to the assessment in the assessments table and select Cancel. You can also open the assessment, select Edit, then select Cancel Assessment.
2. Review the notice about what cancelling means, then select Cancel Assessment.

Cancelled Assessments Are Read-Only

No one can change a cancelled assessment's answers or Contributors, and it's left out of due-date reminders and completion reporting. To reopen it, select Reopen from the same ellipsis menu, or Reopen Assessment in the Edit drawer. It keeps its answers, and its status is recalculated. Cancelling and reopening both notify the Creator and anyone who hasn't finished their part.

Track Progress

The Assessments page lists every assessment you can access, with its status, progress, due date, assignee, and more. Use the search and filters to narrow the list, Columns to choose what's shown, and Download CSV to export it.

For a single assessment, the Change History panel on its Overview tab is an audit trail of who changed what and when, from both DataGrail users and Contributors. Each entry shows the person (or "API Submission" for programmatic changes), the action, and a timestamp. Select an entry to see details such as before and after values.

Tracked events

Change History records these events, grouped into the categories you can filter by:

Category	Events
Questions	Answer added, edited, or cleared
Contributors	Contributor added, removed, or name changed
Documents	Document uploaded or deleted
AI Suggestions	Suggestion generated or accepted
Status Changes	Assessment status transitions
Metadata	Name, due date, or additional context changed
Risks	Risk added from an assessment question

Filtering and Export

Use the Filter dropdown to narrow the history by category. For question changes, you can also filter by question number (for example, Q1.1). Select Export CSV to download the filtered history for audits or sharing.

Notifications

DataGrail notifies people by email, and Slack where noted, as an assessment moves through each step. Select a group to see what's sent, when, and who gets it:

Setup and Invites

These notifications go out when people are added to an assessment or invited to it:

Notification	When	Who gets it
Approver assigned	The template has a default approver, or someone sets the approver	The approver
Added to assessment	The owner or an admin adds a Contributor	The added Contributor
External invite or re-invite	An External Contributor is invited, or their part is sent back	The External Contributor. The link is valid for 7 days.
External Contributor removed	An admin or the owner removes the External Contributor	The removed External Contributor
New invite code	The External Contributor asks for a new link	The External Contributor

Collaboration

These notifications go out by email and Slack while people work on an assessment with comments and assignments. External Contributors get email only.

Notification	When	Who gets it
Assignment created or cancelled	A section or question is assigned, or the assignment is cancelled	The assignee
Assignment resolved	The assignee resolves the assignment	The person who assigned it
Comment reply	Someone replies to a comment	The author of the parent comment
Mention	Someone is @mentioned in a comment	The mentioned person
New top-level comment	Someone posts a new comment that is not a reply	The Assessment Creator only, if they have a user account

Submission and Approval

These notifications go out as parts are submitted and the assessment is approved or cancelled:

Notification	When	Who gets it
External submission	An External Contributor submits. An in-app Contributor who submits sends nothing.	Risk Monitor Admins (Super Admins if there are none)
Part sent back	An admin or the owner reopens one Contributor's part	That Contributor
Ready for approval (email and Slack)	Every Contributor has submitted and the assessment moves to Pending Approval	The assigned approver, unless their own action caused the change or they're no longer active
Assessment approved	The assessment is approved	Risk Monitor Admins (Super Admins if there are none). Not the Creator or the Approver.
Follow-up assessment created	A template rule creates a new assessment after approval	Risk Monitor Admins (Super Admins if there are none)
Assessment cancelled or reopened (email and Slack)	An assessment is cancelled or reopened before approval	The Creator, plus Contributors and External Contributors who have not finished

Scheduled

These notifications go out on a schedule rather than in response to an action:

Notification	When	Who gets it
Due-date reminder (email and Slack)	7, 3, and 1 days before the due date, daily at 8:00 UTC	The approver, the Creator (always), and Contributors with open to-dos. Never External Contributors.
Weekly summary	Mondays at 13:00 UTC	Users with the setting on. On by default for Super Admin, Risk Monitor Admin, and Live Data Map Admin.
Your outstanding work	Mondays at 13:00 UTC, only when the user has open to-dos or an assessment waiting for approval	Users with the setting on. On by default for Super Admin, Risk Monitor Admin, Creator, Requester, and Contributor.

Weekly email contents: The Weekly summary lists each active assessment on your account with its name, status, and due date, and links to its Overview tab. It isn't sent when your account has no active assessments. Your outstanding work lists only the assessments where you still have something to do: an incomplete assignment on an active assessment, or an assessment waiting for your approval. It isn't sent in a week when you have nothing outstanding.

Turning notifications on or off: Each user controls their own notifications in the Notifications section of their Settings page.

Under Risk Assessments, each setting turns on a different set of notifications:

• Assessment Emails: invites, comments, assignments, submissions, approvals, and reminders
• Assessment Weekly Digest: the Weekly summary email
• Assessment Pending Work Digest: the Your outstanding work email
• Assessment Slack Notifications: Slack messages, if your workspace is connected to DataGrail and your account is mapped

External Contributors and Always-Sent Emails

External Contributors always get email, never Slack, and can't turn email off. Their email links open the assessment without a login, last 7 days, and stop working once they're removed.

Two emails ignore user settings. When an inbound assessment is created, the matched internal user gets an email and becomes the creator. When a template rule sends an email, it goes to the addresses in the rule, plus the Creator if the rule says so.

Role Guides

Select your role to see everything you do at each step and every notification you receive. Steps where a role takes no action are left out.

Admins

Super Admin and Risk Monitor Admin have full control of every risk assessment.

Step	What they do	Notifications
Create	Create assessments	—
Invite	Add Contributors and invite External Contributors. A Super Admin can also set the approver.	—
Fill In	Fill in answers and comment. Assign sections or questions.	Comment reply Mention
Submit	Send a part back. Risk Monitor Admins are notified when an External Contributor submits.	External submission
Approve	Approve any assessment. Risk Monitor Admins get the "approved" email and any follow-up assessment email.	Assessment approved Follow-up assessment created
Wrap-Up	Create a new version, or cancel or reopen	—
Ongoing	Weekly summary and outstanding work emails	Weekly summary Your outstanding work

If your account has no Risk Monitor Admins, Super Admins receive the External submission, Assessment approved, and Follow-up assessment created emails instead.

Creator

An Assessment Creator starts assessments and owns the ones they create, including approving their own work.

Step	What they do	Notifications
Create	Create assessments, and become the owner	—
Invite	Set the approver (not themselves), add Contributors, and invite External Contributors	—
Fill In	Fill in answers and comment. Notified of every new top-level comment. Assign sections or questions.	Comment reply Mention New top-level comment Assignment created or cancelled Assignment resolved
Submit	Submit their own part if added as a Contributor, and send a part back	—
Approve	Approve as owner. They don't get the "approved" email.	—
Wrap-Up	Create a new version, or cancel or reopen as owner	Assessment cancelled or reopened
Ongoing	Due-date reminders and outstanding work emails	Due-date reminder Your outstanding work

Requester

An Assessment Requester works like a Creator, but can never approve an assessment or choose its approver. They still get owner emails for the assessments they create.

Step	What they do	Notifications
Create	Create assessments, and become the owner. They're added as a Contributor automatically.	—
Invite	Add Contributors and invite External Contributors. Can't set the approver.	—
Fill In	Fill in answers and comment. Notified of every new top-level comment. Assign sections or questions.	Comment reply Mention New top-level comment Assignment created or cancelled Assignment resolved
Submit	Submit their own part, and send a part back	—
Approve	Can never approve.	—
Wrap-Up	Create a new version, or cancel or reopen as owner	Assessment cancelled or reopened
Ongoing	Due-date reminders and outstanding work emails	Due-date reminder Your outstanding work

Contributor

An Assessment Contributor has a DataGrail account and fills in only the assessments they were added to.

Step	What they do	Notifications
Invite	Added to the assessment. DataGrail grants the Assessment Contributor role automatically.	Added to assessment
Fill In	Fill in answers and comment. Assign sections or questions, and resolve their own assignments.	Comment reply Mention Assignment created or cancelled Assignment resolved
Submit	Submit their own part. Submitting sends no email. If their part is sent back, they're notified.	Part sent back
Wrap-Up	Notified if the assessment is cancelled or reopened before they finish	Assessment cancelled or reopened
Ongoing	Due-date reminders if they have open to-dos, and outstanding work emails	Due-date reminder Your outstanding work

External Contributor

An External Contributor has no DataGrail account. They fill in one assessment through an emailed link that is valid for 7 days.

Step	What they do	Notifications
Invite	Invited by an emailed link. They're also notified if they're removed or ask for a new link.	External invite or re-invite External Contributor removed New invite code
Fill In	Fill in answers and comment through the link. Can be assigned sections or questions, and resolve them.	Comment reply Mention Assignment created or cancelled
Submit	Submit their own part. If their part is sent back, they get a new invite.	External invite or re-invite
Wrap-Up	Access ends. Notified if the assessment is cancelled or reopened before they finish.	Assessment cancelled or reopened

External Contributors get email only, never Slack, and never receive reminders or weekly emails.

Approver

An Approver isn't a role. It's one DataGrail user set on one assessment to sign it off.

Step	What they do	Notifications
Create	Notified if the template has a default approver	Approver assigned
Invite	Notified when they're set as the approver	Approver assigned
Submit	Notified when every Contributor has submitted	Ready for approval
Approve	Approve the assessment. They don't get the "approved" email.	—
Ongoing	Due-date reminders and outstanding work emails	Due-date reminder Your outstanding work

Frequently Asked Questions

Open a question below for answers to common questions about assessment roles, steps, and notifications.

Why didn't someone get an assessment email?

The most common reason is that the user turned off Assessment Emails, or never had it turned on. Ask them to check the Notifications section of their Settings page.

Users also aren't notified about assignments, comments, or cancellations that they made themselves.

Why did a notification go to someone else?

Some emails go only to specific people. For example, the "approved" email goes to Risk Monitor Admins, not to the Creator or the Approver. Check the Who gets it column in the Notifications tables.

Why aren't Slack messages arriving?

Slack messages need a connected Slack workspace and a Slack account for the user. External Contributors never get Slack messages. See Slack Integration.

Which notifications do External Contributors get?

External Contributors always get email and can't turn it off. They don't get Slack messages, reminders, or weekly emails, and they don't get cancel emails after they have finished their part.

When do reminders and weekly emails go out?

Due-date reminders go out 7, 3, and 1 days before the due date, and they stop once the assessment is approved or cancelled. Weekly emails go out on Mondays.