#285 Vendor Risk Assessment/Risk Scoring Bug

[Anonymous]

Originally created by: mapbyter
Originally owned by: LeeMangold

Not sure if I am missing something but I am running into a couple of issues with the vendor management section. I freshly installed OpenGRC using the install.sh script and Sqlite, and then ran that update.sh script for good measure. After staring the application, I went to Checklists > Templates > Create Template and created a new template with a couple of Yes/No questions and a short answer question. This is where I start running into a few different issues.

1. When creating the template, there is no place to define scores or weights for each question. I could be misunderstanding something here, but I thought there would be a way to assign a value to each question to calculate the risk score.

2. When I next go to Vendor Management > MyVendor > Assess Risk and then create and complete an internal assessment using the template I just created, there are a couple of issues.

3. No matter what I choose, Yes/No questions will always evaluate to Yes after submission when the survey is reviewed. (Interestingly, if I use the same template to make a basic checklist in the "Checklist" module that is not tied to a vendor, then the results will be accurate to how it was completed.)

4. After submission, I get a popup that a risk score of 0/100 was calculated. When I go into the survey and click "Score Survey" I get a message that "This survey has no open-ended questions that require manual scoring. All questions can be automatically scored." even when there are open-ended questions like short answer text fields. Also, how is it automatically scoring a question if I can't assign a score/weight as described in number 1 above?

As a small aside, I too am unable to find the built-in survey template as described in GitHub issue [#264]. Again, I am new to this project, and I could be missing something, but after some searching and reading through the docs, I was unable to find a solution.

[Anonymous]

• assigned_to: LeeMangold

[Anonymous]

Ticket changed by: LeeMangold

• status: open --> closed

[Anonymous]

Originally posted by: LeeMangold

Thanks for the detailed write-up. It made this much easier to track down. You weren't missing anything; you found several real bugs.

1. No place to set scores or weights. OpenGRC has two kinds of templates in the same place. Checklists → Templates is for internal checklists and has no scoring. Vendor Management → Survey Templates is where each question gets a risk weight, an impact (whether "Yes" is good or bad), and scores per option for choice questions. The bug was that the Assess Risk screen let you pick a checklist template, which can never produce a score. That picker now only shows vendor assessment templates and points you to the right place to set weights.
   2a. Yes/No always showing "Yes". This was a display bug on the survey review screen: it treated the saved text "no" as true. Your answers were saved correctly, and scoring read them correctly. Only the display was wrong. Fixed.
   2b. "0/100" and the "no open-ended questions" message. These came from [#1]. None of the checklist template's questions had a weight, so there was nothing to score, but the app reported that as 0/100, which reads as "no risk." It now says plainly that no score was calculated and why. The Score Survey page no longer claims everything was scored automatically.

The missing built-in template (#264). You were right, and I owe the reporter on [#264] an apology. On a fresh install.sh install, the built-in Vendor Security Survey templates were never created. The installer didn't run the step that adds them. The fix makes the installer add them, and a new migration adds them to existing installs, so running ./update.sh after the fix is released will bring in "Vendor Security Survey" and "Vendor Security Survey (Internal)". If you had already created or deleted a template with the same name, it won't be touched.

This will be available on main (update or install)