ACL GRC questionnaires part 2
In this blog post, we link to the previous section on ACL GRC questionnaires.
Before we get down to distribution, sending the questionnaires to the recipients, there remains the question of what to do with them. Depending on the application ACL presents a number of possibilities:
In a new analysis you distinguish between different tables, and at the same time different kinds of distribution:
- Data analytics
- Event report
I now want to explain more details of these.
1. Data analytics – The questionnaire is sent to individuals or groups to gather extra information about certain data records/documents.
This calls for a ready filled-in table with events. For the individual data records, by means of the questionnaire, you can question certain facts, or call for information.
There are a number of possibilities when selecting the recipient:
- Licensed GRC user (auditer or dedicated auditer from department) who is to clarify the facts, or oneself if responsible for individual data records.
- An e-mail address as free text, i.e. a random person in the company regardless of whether they have a GRC license or not.
- An entered e-mail address from a field of the table to be worked, i.e. a fixed stake-holder previously determined (for a data record, e.g. an FI posting, that could be the person entering or releasing an invoice).
If you select multiple data records at the same time, you can decide whether the response is to be collective for all data records, or singly for each data record. As soon as the questionnaire is received and answered, the response columns in the table are completed, and you have an excellent overview of all responses of the data lines. Changes to a response are also possible. Changes can be reasoned by comments, and they are also logged, so no kind of information is lost.
This approach of combining tables with questionnaires is of course right for very different scenarios, e.g. also for following up results from preceding checks, or further distribution of data analysis results to departments.
Assuming an analysis across several codes in your company shows possible double payments that should be checked for their actuality. The result of the analysis is uploaded as a table, a corresponding questionnaire is created, and distributed to the stake-holders by company code. As an inspector you then maintain a full overview of working status, and which transactions were really double payments. The feedback may even sharpen analyses, i.e. improve them for subsequent inspections.
The applications for questionnaires together with existing tables are enormous. Just think of the many Excel lists that are sent day by day, filled in, commented, and then sent back and consolidated.
2. Survey – The questionnaire is sent to known or anonymous persons asking them to fill it in.
A survey manages entirely without preceding analyses or standing activities that are to be worked on. Here you distribute the questionnaire directly to specific respondents, or through an anonymous link.
These recipients are then sent the questionnaire by e-mail, and can answer it. As the mailman you keep an overview of what is sent and the status. The questionnaire for a survey can also be distributed over a link. What is special here is that the recipient can only use this link once. After they have answered the questionnaire with this address, they cannot use the link a second time to respond. The same applies to distribution by e-mail. Answering a survey is only possible once, and processing the response is no longer possible unlike the previous data analytics method.
All responses are collected, and can then be evaluated very simply.
Responses over the anonymous link have no entry with the recipient, and questionnaires not yet answered when sent by e-mail are blank in the response columns.
3. Event report – This questionnaire comes as an anonymous link, and can be used to report events.
The last possibility of distributing questionnaires is the event report. Here again, no table or previous analysis is needed.
By this method you provide the potential respondent with a secure link to obtain the previously created questionnaire. Responses are collected centrally and fully anonymously. The link is permanently available and, unlike a survey, can also be used multiple times by one and the same person.
The application is directed quite obviously at a way of reporting events fully anonymously, what is now generally called a whistleblower (hotline). But other applications are also imaginable.
Now that we have seen how questionnaires are created and distributed, we get to further processing of the collected results.
By "Remediate" you find the responses in table form, and can even further process these, if you wish, using further questionnaires, or assign persons and allocate a status. "Investigate" enables you to simply create visualization, and thus obtain a different view of the data. "Indicate" generates metrics of data inventory, and generates references to keep an overview of larger databases. With "Automate" you create triggers that act upon certain events, automatically initiating follow-up action. Triggers are an excellent way of working with questionnaires, for example to send automatic reminders if persons do not respond to your questionnaires, or a notification as soon as a new entry appears in the whistleblower hotline.
Personally I find the questionnaires in the results module extremely practical. They are a central component of this module, and are highly versatile in their use. Maybe a questionnaire must first be created and well planned, but afterwards it saves very much time in the process. Familiarizing with the tool is very easy to grasp, and I believe anyone — without excellent prior knowledge — could create and distribute a questionnaire. Just try it for yourself, and you will fast find new applications that very much simplify your daily chores by means of questionnaires.
Finally I would like to give you the opportunity of answering yourself a questionnaire created with ACL. For this purpose I have created a questionnaire for our blog postings, and distributed it over an anonymous link:
I look forward to your feedback.