Assessment types — category (Assessment or Audit), capability switches, scoring, tiering, summary templates and validation settings

Last updated: October 20, 2026 by Steve

Assessment Types

Assessment types are the top-level kinds of privacy and security assessment your office runs — Privacy Impact Assessment (PIA), Algorithmic Impact Assessment (AIA), Security (SEC), an audit, or a custom type. The type a coordinator picks at creation decides which templates are offered, whether the scoring and tiering tools apply, whether the harm-to-individuals lens appears on the risk register, and which summary template produces the closing report.

Assessment Types

Where to Find It

Open Settings from the app toolbar and choose Assessment types in the Assessments & controls group. This group is visible only to users who hold the relevant privacy configure permission.

The List

Assessment types use the shared Settings list. Click a row to open a read-only view of its settings, and use Edit in the footer, or the pencil on the row, to open the form. The bin deletes a type you added. A built-in type, or one delivered by a jurisdiction pack, shows the bin greyed out with the reason, so turn it off with Enabled instead. Drag a row (or press Alt+Up / Alt+Down, or use the move arrows) to set the order the lists and pickers show; only the position is saved. The list also shows each type's Category.

Options and Fields

Field What it controls
Name and description The type's label, translatable so it reads correctly in each active language. PIA, AIA, and Security are the standard types; you can add custom types.
Scoring and tiering Enables the likelihood × impact risk register and overall-risk tiering on assessments of this type. When on, a note appears at creation telling the coordinator that scoring applies.
Harm-to-individuals lens Enables the harm-to-individuals (RROSH) determination on the risk register for this type.
Summary template The report template used to generate the regulator summary produced at closure.
Category Assessment or Audit. A type in the Audit category is an audit and lives on the Audits board; any assessment type can be moved to the Audit category here.
Security categorization and authorization Switches on the security-assessment workflow for this type: the Categorization, Controls, POA&M and ATO tabs.
Control testing Lets an assessment of this type test controls from the controls library.
Plan of action Switches on the plan of action (POA&M) for assessments of this type.
Engagement tracking, Findings register, Evidence requests What an audit of the type carries: the Engagement and Contacts cards, the Findings tab and the Evidence requests tab.
Validation steps The opinions to seek, the decision with its outcomes, the attestations and signature, and the regulator consultation regimes with their reply and extension periods.
Section evaluation Whether the questionnaire's sections are evaluated (off, optional or required) and the scale used.
Risk matrix The levels, their definitions and the level of each likelihood and impact pair.

How It Affects Assessments

  • At creation, the chosen type filters the template list — templates built for that exact type sort first, generic templates follow.
  • For scored types, a note appears in the create dialog, and the assessment's Risks tab exposes the 5-point likelihood × impact register with the effective overall-risk override.
  • For types that enable the harm lens, the risk register adds the harm-to-individuals (RROSH) determination.
  • At closure, the type's summary template drives the generated regulator summary that the Closure tab exports.
  • A type with the security categorization and authorization switch on (the Security type, in the standard packs) unlocks the security workflow: generate SSP/SAR actions and the Categorization, Controls, POA&M and ATO tabs. Before 2.5.0 this was fixed to the Security type; the category and the capability switches now decide it.
  • Which audit parts appear depends on the audit type's switches, not on its name: a type with engagement tracking shows the Engagement and Contacts cards, one with a findings register shows the Findings tab, and one with evidence requests shows the Evidence requests tab. See Audit Types.
  • Control testing on a type adds the Controls tab where controls from the controls library are tested.

Validation Settings

The validation steps, the section evaluation and the risk matrix are each a configuration document. It is checked when you save: an invalid document is refused with the reason, and a valid one is summarized in one line (the matrix also shows its bands by cell). A value set on an assessment template replaces the type's whole value; leave it blank on the template to use the type's. Entering {"version":1} on its own switches the type's validation steps off.

These settings are not structural: changing them on a type in use applies to its assessments at once, except that a rating an evaluation already uses cannot be removed from the scale. Saving a type or template can also change a filing rule, in which case only the open assessments of that type are brought onto it; assessments already in effect or closed keep what they took effect with. See DPIA Validation for how the steps work on an assessment, and Screening Lists for the regulators' lists the screener reads.

Best Practice

Seed your assessment types from a jurisdiction pack so PIA, AIA, and Security arrive pre-wired to the right templates and scoring behavior, then adjust only what your program requires.

Retention

Each assessment type carries a retention period (months) that governs when its closed assessments become eligible for disposition, measured from the closed date. Blank means keep indefinitely (the default). Note that only Closed assessments ever age out — an assessment sitting In Effect is the standing privacy record for its program and is never eligible. See Retention Review.

←
Previous Attestation Templates
Next Assessment Statuses
→