Measures are what your organisation does to reduce risks, close gaps in the baseline check or resolve findings. This guide shows how you create, implement and evidence measures, including recurring ones. It is aimed at the people responsible and at everyone who plans measures.

Before you start

  • Measures usually arise where the need appears: in the treatment plan of a risk, for a deviation in the baseline check or for a finding. You can create them directly under Measures with New measure.
  • Anyone responsible for a measure can see it even without further permissions. The list is then called My measures.
  • The status is changed by the people responsible and by people with the “Measures: Edit” permission.

How to create a measure

  1. Open Measures and click New measure.
  2. Enter the Title and Description and choose the affected Assets or Organisation. If you may only create measures for your own assets, “Organisation” is not available.
  3. Assign the Requirements that the measure implements and, optionally, an objective. For measures of a risk with the treatment option “Reduce”, the requirements are required; otherwise the treatment plan cannot be approved. In all other cases, they are optional.
  4. Choose the Type of measure: preventive, immediate or corrective measure. An immediate measure limits damage quickly; a corrective measure removes the cause so that it does not happen again.
  5. Define the Responsibility: one or more people, exactly one of them as Primary (star).
  6. Choose the Recurrence: One-off for a single implementation, otherwise monthly, quarterly, half-yearly or annually.
  7. Set the date: Due on for one-off measures, First execution by for recurring measures.
  8. Save.

Measures from a risk are created by the reviewer directly in the assessment form. The risk owner then decides who implements them by approving the treatment plan. Until then, the measure shows Awaiting approval and remains “Planned”.

  1. Planned

    From a risk: waits until the treatment plan is approved.

  2. In progressWith “Start implementation”.
  3. Implemented

    With “Report as implemented” and a short description.

Recurring measure

With the first recorded execution, it is “In operation”. 7 days before each due date, the task “Execution due” is created.

Something still missing?

With “Reopen”, the measure is open again, and the people responsible receive a task again.

Status of a measure

A measure starts as “Planned”; if it comes from a risk, it waits until the treatment plan is approved. With “Start implementation”, it becomes “In progress”, and with “Report as implemented”, “Implemented”. A recurring measure is “In operation” after the first recorded execution; before each due date, the people responsible receive a task. With “Reopen”, an implemented measure can be opened again.

How to implement a one-off measure

  1. Open the task Implement measure under My tasks or the measure itself.
  2. Click Start implementation. The status changes from “Planned” to “In progress”.
  3. In the Attachments tab, attach evidence: a PDF file of up to 20 MB or, with Add link, a link to your storage location, such as SharePoint or the intranet.
  4. Click Report as implemented and briefly describe what was implemented.

If something is still missing, open the measure again with Reopen. The people responsible then receive a task again.

How to record recurring measures

Recurring measures are activities at a fixed frequency, for example installing patches. Regular checking, on the other hand, is an internal control in the internal control system.

  1. Open the measure. Under Executions, click Record execution.
  2. Enter when it was carried out (Carried out on) and the Result: OK or Deviation. You describe a deviation.
  3. Upload the Evidence (PDF). It is required for every execution. Links are not possible here.

With the first execution, the measure is “In operation”. The next due date follows the fixed frequency. Executions and their evidence can no longer be changed or deleted afterwards.

What happens next

  • For one-off measures from a risk: once all measures have been implemented, the reviewer assesses the residual risk. See Reporting, reviewing and treating risks.
  • For recurring measures, the people responsible receive the task Execution due 7 days before each due date. Once the date has passed, the execution is considered overdue without any tolerance.
  • If a measure is not carried out as planned or is carried out with a deviation, the risk owner sees this on the risk. They receive the task Measure is not being carried out as planned and can have the risk reassessed.
  • If you assign requirements to a measure, it is listed as an implementation on the requirement's page.
  • “Report as implemented” does not yet mean that the measure is effective. For a risk, whether it is effective is shown by the reviewer's assessment of the residual risk; effectiveness can be checked regularly with an internal control in the internal control system.

Frequently asked questions

Can I add evidence later?

Yes, in the Attachments tab, as long as you are responsible for the measure or may edit it. Evidence of a recorded execution remains unchanged.

Why can't I start the implementation?

If the measure belongs to a treatment plan that the risk owner has not yet approved, it waits. Starting also requires a responsible person.

How do I treat a gap in the baseline check?

For the requirement, choose Will be fixed – measure. See Carrying out the baseline check for assets.