Set up risk tiering workflows
Risk tiering workflows let you govern risk tier assessments and templates with the same workflow engine you use for records and artifacts. A review can start automatically when an assessment or template is published, advance a governance stage as it runs, require approvals, and route differently based on the assessed risk tier.
Prerequisites
- Active ValidMind login
- Customer Admin role or equivalent permissions to manage workflows
- Governance Admin or Validator role with
manage_risk_tier_templatepermission to define governance stages - An active risk tier template published for at least one record type1
- Risk tiering enabled for your organization
About risk tiering workflows
A risk tiering workflow applies to one of two subjects:
- Risk tier assessment workflows govern a record type’s risk tier assessments. The workflow is scoped to an inventory record type, and its stages and branch conditions come from that record type’s currently active risk tier template.
- Risk tier template workflows govern a specific risk tier template across the organization — for example, requiring a review before a new methodology version takes effect.
Both kinds of workflow can move a governance stage as they run. Governance stages — for example: In Development → In Review → Approved / Changes Requested — track review progress and are separate from the Draft → Active → Archived lifecycle status.2 Publishing still moves the status; a workflow moves the stage.
Define governance stages
Governance stages are defined per template, in two independent sets — one for the template itself, one for assessments made against it. Each set feeds a different workflow step:
| Stage set | Applies to | Used by workflow step |
|---|---|---|
| Risk Tier Template Stages | The template itself | Risk Tier Template Stage Change |
| Risk Assessment Stages | Assessments made against the template | Risk Assessment Stage Change |
To define stages:
In the left sidebar, click Settings.
Under Governance, select Risk Tier Stages.
Select the template to define stages for.
Select the Risk Tier Template Stages or Risk Assessment Stages tab, depending on which stage set you want to define.
Click Add Stage, then enter a Name and select a Color.
Drag and drop to reorder stages into the order your review moves through them.
A stage cannot be deleted while an assessment or template is currently in that stage. Deleting a stage that a workflow step still references is allowed, and silently breaks that step — the run stops advancing with no error shown. Update or remove the stage-change step before deleting its stage.
Add a risk tiering workflow
In the left sidebar, click Settings.
Under Governance, select Workflows.
Select the Risk Tiering Workflows tab.
Click Add Risk Tiering Workflow.
Enter a Title and a Description for the workflow.
Under Applies to, select the workflow’s subject:
- Risk Tier Assessment — Govern a record type’s risk tier assessments.
- Risk Tier Template — Govern a risk tier template across the organization.
Select the workflow’s scope:
- For assessment workflows, select the Inventory Record Type. Only record types with an active risk tier template are available. Stages and branch conditions in the workflow use the configuration of that record type’s active template.
- For template workflows, select the Risk Tier Template to govern. Stages in the workflow use that template’s configuration.
Under Workflow Start, select when the workflow should be initiated:
- Manually — Start this workflow on demand from the assessment or template page.
- On Risk Assessment Published — Start this workflow automatically each time an assessment is published. (Assessment workflows only.)
- On Risk Tier Template Published — Start this workflow automatically each time a version of the template is published. (Template workflows only.)
Click Save Draft to save your workflow, and then configure your workflow steps.3
The subject and scope are structural and cannot be changed after the workflow is created.
Only one workflow starting on publish is allowed per inventory record type (for assessments) or per template (for templates), so publishing fires exactly one governance workflow. Manually started workflows are not limited this way — you can create as many as you need.
Configure risk tiering steps
Risk tiering workflows use the same workflow canvas and step types as record and artifact workflows,4 with these subject-specific capabilities:
Move the governance stage. Add a Risk Assessment Stage Change step (assessment workflows) or a Risk Tier Template Stage Change step (template workflows) to move the subject’s governance stage as the review runs — for example, set In Review when the review starts, and Approved or Changes Requested on the outcome of an Approval step.5
Branch on the assessed risk tier. In an assessment workflow, a Condition Branch can route on Risk Assessment Field: Assessed Risk Tier — the tier level of the assessment the workflow is running against. Use it to send high-tier models through a stricter review path than low-tier ones. The available tier values come from the record type’s active template.
Require approvals. Connect an Approval step’s rejection and approval paths to stage-change steps, so a vote moves the assessment or template into the matching governance stage.
When your steps are configured, publish the workflow to put it into effect.6 A draft workflow never runs — it cannot be started manually, and a publish-triggered draft does not fire when an assessment or template is published.
Track governance on the assessment or template
On the assessment detail page7 and the template detail page:8
- The assessment stage or template stage badge in the sidebar shows the current governance stage. The badge can also be set directly by users with edit access to the assessment or template.
- The active workflows section lists the workflow runs for that assessment or template. Click See All Workflows to review available workflows, start a manually triggered workflow, or inspect a run.
The stage badge and workflow list update live as a workflow advances — including right after an approval vote — without reloading the page.
How governance runs behave
Risk tiering workflows are built around one principle: an approval attests to a specific published version.
- One published version = one governance run. A publish-triggered workflow runs once per published version and stays bound to the exact version it judged. Publishing a new version archives the previous version, ends any of its still-active runs as aborted, and starts a fresh review of the new version — a full re-review, not a resumption. An archived version is terminal for governance: no workflow can start on it, so a re-run always targets the current version, not the displaced one.
- Approval does not publish. A workflow moves stages and records approvals, but it never changes the Draft/Active/Archived status. When a review of a draft is approved, a person clicks Publish — the publishing decision stays with the author.
- Rejection ends the run. A rejection typically moves the stage to something like Changes Requested, and the run ends. To address the feedback, revise and publish a new version — a publish-triggered review re-runs automatically, and a manual review can be re-run on demand.
- Publish-triggered and manual reviews are different tools. Use a publish-triggered workflow as the governance backbone that runs on every publish, and manual workflows for on-demand reviews — such as governing a draft before it is published.
What’s next
- Working with risk tiering — concepts, lifecycle overview, and roles.
- Manage risk tier assessments — create, publish, and version assessments.
- Workflow step types — configuration reference for every workflow step.
- Working with workflows — the full workflows guide.