🛠 Create Your Own - DORA Risk Assessment Workflow

  Estimated Read Time: 10 minutes

➕ Requires the Vendor Portal

⚠️ DORA Risk Assessment Workflow Automatically Creates 50 Custom Fields

---

Sections in this article:

• Introduction
  
  • DORA Risk Assessment Questionnaire (Smart Form)
• Mandatory Configuration
  • Add the Template
  • Configure the DORA Risk Assessment Status Field
  • Configure the Trigger
  • Add the DORA Assessment Status to the Workflow Form
  • Set the AutoAction Values
• Additional Configuration
  • Configure Recurring Reviews
• Additional Setup Outside the Workflow
  
  • Add the Custom Status Field to Other Workflows
  • Add Vendor Users
• ⚡️Getting Started - Activate the Triggers⚡️

---

Introduction

The DORA Risk Assessment best practice workflow uses a scored form to give you a structured assessment of your vendors against the Digital Operational Resilience Act (DORA), tailored for financial services IT vendors. Once the assessment has been sent, the vendor receives an email asking them to complete and submit the form via the Vendor Portal.

DORA Risk Assessment Questionnaire (Smart Form)

The questionnaire has 50 questions, each answered with either a dropdown selection (Yes, No or N/A) or a file attachment. It’s built as a Smart Form, so every question is pre-scored and weighted based on the response, and the final score is stored on the vendor record for easy access and transparency.

Mandatory Configuration

The steps in this section outline the essential setup required to make your workflow fully functional:

• Add the DORA Risk Assessment workflow template to your tenant as the starting point for the build
• Create the custom DORA Assessment Status field that pulls vendors onto the workflow
• Configure the trigger to start the workflow when a vendor is set to DORA Assessment Required
• Add the DORA Assessment Status to the workflow form, and configure the AutoAction so that the status updates when the review is complete

The ⬇️ Additional Configuration ⬇️ section covers optional additions to expand the scope of your process or tailor the workflow to better align with your organisation’s unique policies, procedures, and Gatekeeper subscription features.

Add the Template

To get started, you'll need to add the template workflow:

1. From the navigation menu, click Workflows.
2. Click Add, then select Workflow Template.
3. Click Create on the DORA Risk Assessment template.
4. Amend the title if needed, then click Create.

Configure the DORA Risk Assessment Status Field

A custom DORA Assessment Status field is required so that vendor records are pulled onto the workflow automatically. To configure this:

1. From the navigation menu, expand Settings, then click Configuration.
2. Click Custom Data.
3. Click an existing vendor custom data group, or add a new one to store this field in. If you’re planning to run more contract and vendor management processes in parallel, consider adding a custom data group to store all related statuses.
4. Within the custom group, click Add New Custom Field.
5. Enter a label for the field, e.g. DORA Assessment Status, and select Dropdown list as the type.
6. Add the following dropdown options, then click Save.
   1. DORA Assessment Required
      
   2. DORA Assessment Complete
   3. N/A

Configure the Trigger

After creating the custom DORA Assessment Status field, configure the trigger using it as a condition:

1. From the navigation menu, click Workflows.
   
2. Expand the 3 dots on the relevant workflow, then select Workflow Triggers.
3. Click the New DORA Assessment Required trigger to edit it.
4. Click Add to assign the field you created as the trigger condition, as below:
   1. DORA Assessment Status  ➡️  is one of  ➡️  DORA Assessment Required
5. Click Create. 

Add the DORA Assessment Status to the Workflow Form 

You’ll need to add the DORA Assessment Status field to the workflow form, so that it can be updated automatically once a vendor completes the process.

1. Click the start phase of the workflow to edit it.
2. Navigate to Form, then click Add Section and enter a section name.
3. Select the following from the dropdown lists:
   1. Predefined: Vendor
   2. Custom Data Group: The custom group that contains the DORA status field
4. Click Save.

You should then hide this field on the workflow form, so that users cannot update it manually. To do this:

1. Click the cog icon to access the workflow configuration.
   
2. Locate the form section that contains the DORA Assessment Status field.
3. Select Hidden from the dropdown list on the start phase, then click the copy icon.
   
4. Select the checkboxes for all other phases in the workflow. This will apply the settings for this section from the start phase to all other phases.
   
5. Click Copy to save the changes.

Set the AutoAction Values

Once you’ve added the field to the form, configure the AutoAction so that a vendor’s status is updated when the workflow is complete:

1. Click the Review Completed phase to edit it.
2. From Actions, click Edit AutoAction Values alongside AutoAction | Update Vendor.
3. Set the DORA Assessment Status dropdown value to DORA Assessment Complete.
4. Click Save.

Additional Configuration

This section covers optional steps to adjust the workflow’s scope or default settings, helping you tailor it to your organisation’s needs.

Configure Recurring Reviews

If your organisation requires DORA assessments on an annual or recurring basis, you can configure the workflow to repeat at scheduled intervals.

Part 1: Add a Custom Date Field

First, add a custom date field that will pull vendors onto the workflow at the right time.

1. From the navigation menu, expand Settings, then click Configuration.
2. Click Custom Data.
3. Click an existing vendor custom data group, or add a new one to store this field in.
4. Within the custom group, click Add New Custom Field.
5. Enter a label the field, e.g. DORA Yearly Review, and select Date as the type.
6. Click Save.

Part 2: Add the Date Field to the Form

Next, add the date field to the workflow form, so that it can be populated automatically as part of the workflow.

1. Click the start phase of the DORA Assessment workflow to edit it.
2. Navigate to Form, then click Add Section and enter a section name.
3. Select the following from the dropdown lists:
   1. Predefined: Vendor
   2. Custom Data Group: The custom group that contains the DORA Review field.
4. Click Save.

Part 3: Set the Date via AutoActions

Once you have added the DORA Review Date field to the workflow, configure the AutoAction so that the field is populated on the vendor’s record when the workflow is complete:

1. Click the Review Completed phase to edit it.
2. From Actions, click Edit AutoAction Values alongside AutoAction | Update Vendor.
3. From the DORA Review field, select the relevant period of time e.g. 12 Months after Today.
4. Click Save.

Part 4: Create a Trigger

Finally, set up a trigger to pull vendors onto the workflow automatically when their DORA review date is approaching.

1. From the navigation menu, click Workflows.
   
2. Expand the 3 dots on the relevant workflow, then select Workflow Triggers.
3. Click the DORA Risk Assessment - Refresh Required trigger to edit it.
4. Under Conditions, click Add then locate the newly created custom date field.
5. Configure the condition, for example Next DORA Review occurs in 7 Days, then click Create.

Additional Setup Outside the Workflow

If you’ve followed all of the steps above, your workflow is nearly ready to launch. To help the process run smoothly and reliably, there are a few additional areas of your tenant worth reviewing.

Add the Custom Status Field to Other Workflows

When running the DORA Risk Assessment workflow alongside other vendor assessment processes, such as onboarding, it’s recommended to start it automatically when a new vendor is added. To do this, add the DORA Assessment Status field to the other workflow’s form, then use an AutoAction to set it to DORA Assessment Required when the vendor is created.

This lets multiple onboarding activities run in parallel, helping you onboard vendors faster. To learn about configuring this, see Parallel Workflows.

Add Vendor Users

Before vendors can complete the DORA Assessment questionnaire on the Vendor Portal, ensure that the relevant contacts have been added as vendor users:

1. From the navigation menu, expand the Vault, then click Vendors.
2. Click on the relevant vendor record to open it.
3. Click the Vendor Users tab to view existing contact details.
4. Click Add, then select Vendor User to add a new contact.

⚡️Getting Started - Activate the Triggers⚡️

Once your workflow is fully configured, activate the triggers to make it live:

1. From the navigation menu, click Workflows.
2. Expand the 3 dots on the relevant workflow, then select Workflow Triggers.
3. For any trigger with a Pipeline status, click on the trigger’s name.
4. Click the pencil icon on Trigger Status.
5. Select Live from the dropdown list, then click Update.
6. Click < Back to return to the list of triggers.
7. Repeat steps 3-5 until all triggers are live.