With the release of C1Risk Version 3.12.0, we have standardized how record statuses behave after completing an approval workflow.

Why This Change Was Made

Previously, completing an approval workflow often resulted in a record's operational Entity Status being set to "Approved." However, "Approved" represents a step in an authorization workflow rather than an operational lifecycle state.

To eliminate confusion and ensure consistency across the platform, Release 3.12.0 aligns each entity's operational status with its actual final operational state once approved. The "Approved" status has been removed from several operational status dropdowns, and records will now transition automatically to more descriptive, action-oriented lifecycle states.

Summary of Status Transitions

Detailed Operational Changes by Module

1. Assessments

• Operational Behavior: When an Assessment is marked as Approved via the approval workflow, its operational status automatically transitions to Closed.
• Interface Adjustments: The manual "Approved" option has been removed from the operational Status dropdown to prevent users from selecting a workflow state as a final lifecycle stage.

2. Document Requests (DR)

• Operational Behavior: Once a Document Request is approved, its operational status transitions automatically to Submitted (indicating that the requested evidence has been officially accepted and submitted to the GRC repository).
• Interface Adjustments: The "Approved" option has been removed from the operational Status dropdown.

3. Test Results

• Operational Behavior: When a Test Result's approval workflow is completed and marked as Approved, its operational status automatically changes to Closed. This ensures that approved tests are correctly categorized as finalized.

4. RCSA & Business Continuity Management (BCM BIA & BCM Plans)

• Operational Behavior: When an RCSA, BCM BIA, or BCM Plan is Approved, its operational status automatically transitions to Active.
• Continuous Monitoring & Activation:
  • The "Approved" status has been removed from the dropdown and replaced with Active.
  • A new Activate option has been added to the Action Menu. Once activated, the record is flagged for continuous monitoring, ensuring that risk controls and resilience plans remain actively tracked.

5. Assessment Campaigns

Assessment Campaigns are system-level configurations and do not use individual, multi-step workflow approvals. To improve clarity and prevent user errors:

• Operational Status Lifecycle:
  • New: The campaign is in draft format.
  • Pending: The campaign is launching, but some assessments are still being initialized.
  • Active: All assessments are launched and actively sent to assignees.
  • Closed: The campaign is complete. This locks the Assessment Campaign record from edits and disables the action menu on the Assessments subtab.
  • Archived: The campaign is archived and the record is locked from further edits.
• Interface Adjustments:
  • To prevent confusion, the "Submit for Approval" and "Create Approval Process" buttons have been completely removed from the Assessment Campaign detail pages.
  • Once a campaign is moved to Archived status, the entire record is locked, and edit capabilities are disabled to protect historical audit data.

What Actions Do You Need to Take?

• Workflow Adjustments: No manual action is required! All existing approval processes will automatically adopt these standardized status transitions.
• Filters and Reporting:
  • Updating Status Filters: If you have custom saved list views or reports that filter specifically for Status = "Approved" on Assessments, Document Requests, RCSAs, BIAs, or BCM Plans, please update those filters to search for the new standardized operational statuses (Closed, Submitted, or Active).
  • Using Approval Status: To filter, report, or query records that have successfully completed their approval workflow process, you should now use the dedicated Approval Status field with the filter criteria Approval Status = "Approved". This separate field remains fully functional and allows you to isolate approved records independently of their operational lifecycle state.