Asset reviews

An inventory goes out of date: systems are replaced, owners change, ratings no longer fit. An asset review checks the entries of your asset inventory one by one. A reviewer approves each asset that is still correct and rejects the ones that are not. A rejection becomes a finding in the findings register.

An asset review is not an access review, which checks who may use each asset.

The tasks below follow the order of the work:

• Start an asset review
• Approve or reject each asset
• Finish the review

Scripts and integrations: see API below.

Start an asset review

1. Open Assets → Reviews and choose Start Asset Review.
2. Enter a Title, such as "Annual asset inventory review".
3. Choose the Coordinator role. Its members are notified and run the review.
4. Choose the Priority, which sets the scope:
   • All Assets
   • High Risk Assets Only: the highest rating is 7 or more.
   • Medium Risk Assets Only: the highest rating is 4 to 6.
   • Low Risk Assets Only: the highest rating is 1 to 3.
   • Due Soon or Overdue: assets whose Retention period comes due within 14 days, or is past.
5. Set a Deadline and add Notes if you want.
6. Choose Create.

The review takes a copy of each asset in scope at this moment. Archived assets are left out. Retired assets are included. The three risk scopes use the asset's effective rating and leave out unrated assets.

Approve or reject each asset

1. Open the review and click an asset to expand it.
2. Under Summary of Changes, see what changed since the copy was taken. Use Compare with to pick the version to compare against, and Split View to see both side by side.
3. Choose Approve if the entry is still correct.
4. Choose Reject if it is not. Choose a Finding type, write the Reason and confirm.

A rejection raises a finding numbered NC-, OBS- or OFI-, after the findings you already have. If a later asset review is already planned, its deadline becomes the finding's deadline. The review page lists the findings it raised. The next asset review shows the findings of earlier reviews that are still open.

To change a decision while the review is open, choose Withdraw. The asset goes back to Pending. The finding of a rejected asset is then archived with a note, not deleted.

An approval counts at once. The overview finding Review due clears for that asset, even before the review is finished.

Finish the review

1. When every asset is approved or rejected, choose Finish Review and confirm. The review is locked.
2. To keep a copy for the auditor, open Actions and choose Generate Report.

Finishing records the review as the last review of each asset in it. The scope Due Soon or Overdue counts the next retention date from there.

Reference

Fields

Each review gets a number such as AAR-002. Owners and admins start reviews and decide assets. Members and auditors read them. On the Free plan you can keep 4 asset reviews. Archived reviews do not count.

API

Read and delete use the singular path /asset-review/{id}/. All other calls use the plural.

priorityFilter is ALL, HIGH_RISK, MEDIUM_RISK, LOW_RISK or DUE_SOON. To approve an asset, send "approved": true. The reject call takes reason and findingType: MAJOR_NONCONFORMITY, MINOR_NONCONFORMITY, OBSERVATION or OPPORTUNITY_FOR_IMPROVEMENT. To finish the review, send finishedAt with PATCH /asset-reviews/{id}/. While an asset is undecided, the call returns 412.

Each item holds a snapshot of the asset at the start of the review, with the asset's own ratings, not the class ratings.