ICT service assessment issues
Troubleshooting guide for ICT service assessment fields: when they apply, why extra fields become mandatory, what audit date to enter, and how to handle exit, reintegration, and alternatives.
What this issue group covers
This page covers common issues in the ICT service assessment part of the register.
It applies where an ICT service supports a critical or important function, or a material part of one, and you need to complete the related assessment fields correctly.
Issues covered on this page
-
I am not sure whether this contract needs an ICT service assessment
-
I do not know whether this requires an exit plan or reintegration assessment
I am not sure whether this contract needs an ICT service assessment
What this usually means
You are looking at the ICT service assessment fields and need to decide whether this row belongs in that part of the register. The key check is whether the specific ICT service supports a function where Importance assesment is set to Yes.
What to check and how to fix it
Check the linked function for this row and its Importance assesment value.
If that value is No or Assessment not performed, go back to the function record before completing this assessment section.
Check the Contract reference ID, provider, and Type of services for the row you are assessing.
If those do not match the service you intend to assess, correct the row before continuing.
Check whether the provider on this row is the provider that should be assessed for this ICT service.
If the wrong provider is attached to the row, correct the provider entry before you continue.
Check whether the Type of services on this row is the ICT service that supports the critical or important function.
If the wrong value is recorded, correct it before completing the assessment fields.
Once the linked function, provider, and Type of services all match the row you need, complete the ICT service assessment for that row and save the record.
Another field became mandatory
What this usually means
Your Service replaceability answer makes Reason if the provider is not replaceable mandatory. That happens when Service replaceability is set to Not substitutable or Highly complex substitutability.
What to check and how to fix it
Check Service replaceability first.
If it was selected by mistake, correct it before filling any follow-on field.
If Service replaceability is set to Not substitutable or Highly complex substitutability, complete Reason if the provider is not replaceable before moving on.
Check that the reason matches the actual issue.
If the problem is lack of real alternatives, choose that reason. If the problem is migration or reintegration difficulty, choose that reason. If both apply, choose the combined reason.
Check that the reason is for the specific ICT service and provider on this row.
If you are relying on a general supplier view, replace it with the service-specific reason.
Save the record and validate again.
My audit date is being rejected
What this usually means
The value in ICT provider’s last audit date is either not a qualifying audit date for that ICT service, or it is not in the required date format.
What to check and how to fix it
Check that ICT provider’s last audit date comes from an audit of the specific ICT service provided by that provider.
If it comes from a different service or arrangement, replace it with the correct date.
Check who carried out the audit.
If the date comes from a provider certification, a provider internal report, an annual monitoring date, or a risk assessment review date, do not use it here. Use a date from internal audit, pooled audit, or a third party appointed by your entity.
Check the date format.
If the value is not entered as yyyy-mm-dd, re-enter it in that format.
If no qualifying audit was performed, do not enter a different date just to complete the field.
Use the no-audit value in the next section instead.
Save the record and validate again.
I did not perform an audit
What this usually means
You do not have a qualifying value for ICT provider’s last audit date, but the field still needs to be completed.
What to check and how to fix it
Check whether any qualifying audit was performed for the specific ICT service by internal audit, pooled audit, or a third party appointed by your entity.
If yes, return to ICT provider’s last audit date and enter that date.
If no qualifying audit was performed, enter 9999-12-31 in ICT provider’s last audit date.
Check that you are not using a certification date, provider report date, annual monitoring date, or risk assessment review date instead.
If you are, remove it and use the no-audit value.
Save the record and validate again.
I do not know whether this requires an exit plan or reintegration assessment
What this usually means
You need to work out whether to complete only Does the exit plan exist?, or both Does the exit plan exist? and ICT service reintegration possibility.
What to check and how to fix it
Check the linked function’s Importance assesment value.
If it is No or Assessment not performed, return to the function record first before completing this assessment section.
Check the provider type for the row.
If the ICT service is provided by an ICT intra-group service provider, complete Does the exit plan exist? for the specific ICT service.
Use ICT service reintegration possibility where the ICT service is provided by an ICT third-party service provider that is not an ICT intra-group service provider.
Check that both answers are for the specific ICT service and provider on the current row, not from a general contract view.
If they are not service-specific, correct the row or the answer before moving on.
Save the record and validate again.
I did not perform an alternative-provider assessment
What this usually means
The row needs the result of the assessment to identify an alternative service provider, but that assessment was not performed.
What to check and how to fix it
Check the linked function’s Importance assesment value.
If it is No or Assessment not performed, return to the function record first before completing this assessment section.
Check whether your entity performed the assessment to identify an alternative service provider for this ICT provider and ICT service.
If yes, record the actual result in Alternatives assessement.
If the assessment was not performed, select Assessment not performed in Alternatives assessement.
Use Alternative ICT providers only when the result in Alternatives assessement is Yes.
If the result is No or Assessment not performed, leave that field empty.
Save the record and validate again.
What to do next
After you correct the relevant assessment row, save the record and validate again. If the issue remains, check the linked function record first, then recheck the provider and service details on the assessment row.