Online Assessment

Introduction

Summary

Online Assessments help you collect information from people inside or outside your organisation using structured questionnaires.

The process involves two roles: the recipient, who answers questions and provides evidence, and the assessor, who reviews the responses and records a conclusion. Recipients use the Online Assessment portal, while assessors track progress, review answers, and document findings that require follow-up.

This course explains the main concepts and guides you through a complete test assessment. You will prepare a questionnaire, invite a recipient, review their answers, record results, and track findings before moving into ongoing operation.

Typical Scenarios

Online Assessments can be used for:

• Supplier assessments: Ask suppliers about their practices, review their evidence, and follow up on gaps.
• Internal assessments: Collect information from departments to support risk identification and understand how activities are performed.
• Gap assessments: Gather evidence about current practices and identify where improvements are needed.

Supported Versions

This feature is available only in the Enterprise edition.

Workshops

If you are an enterprise customer, you can purchase 8-hour implementation workshops delivered by GRC professionals. Contact support@eramba.org for more information.

Theory

Module Relationships

The Online Assessment (OA) module can operate independently. Depending on your use case, you can associate assessments with records in other modules:

• Supplier assessments: associate the assessment with a Third Party.
• Application or asset assessments: associate the assessment with an Asset.
• Risk assessments: associate the assessment with a Risk.
• Data privacy assessments: associate the assessment with a Data Flow.

These relationships help you keep assessments connected to the records they concern.

The OA module also includes several tabs that support the assessment process:

• Questionnaires: maintain the library of questionnaires used in your assessments. Each questionnaire contains one or more questions.
• Feedback: view the answers provided by assessment recipients.
• Findings: record issues or gaps that require follow-up.
• Audit Trails: view recorded activity within the module.

Online Assessments

Each time you want someone inside or outside your organisation to complete a questionnaire, create an Online Assessment under Security Operations / Online Assessments.

You can create assessments individually using a form or in bulk using CSV imports. See the CSV Imports documentation for instructions.

The main settings are:

• GRC Assessor and Recipient: identify who reviews the answers and who completes the questionnaire. You can assign users or groups. Notifications must be enabled and configured separately.
• Authentication: choose whether the recipient accesses the OA portal through a magic link or by signing in. A magic link allows access without entering login credentials.
• Questionnaire: select a questionnaire from your library. Once you save the assessment, you cannot change which questionnaire it uses.
• PDF report: optionally allow the recipient to download a report from the portal. Use the Reporting functionality to configure its contents.
• Submit Incomplete: decide whether recipients can submit the assessment before answering every question.
• Start Date and End Date: define when the assessment starts and stops accepting answers. You can also start or stop it manually.
• Recurrence: configure the assessment to repeat automatically. You can choose whether to populate the repeated assessment with previous answers.

After creating an assessment, select it in the Online Assessments list to access actions such as starting or stopping it and obtaining its portal URL.

Questionnaires

Before continuing, review the following common feature documentation: CSV Imports

Questionnaires form a reusable library for your assessments. Prepare them in a spreadsheet and import them into eramba using the questionnaire CSV template. You can use the web interface to make individual changes.

Follow the template instructions carefully. Each row represents a question, and the file must use the required format.

Questionnaires support the following structure and options:

• Chapters: organise questions into sections. Chapters and questions have identifiers, titles, and descriptions.
• Answer types: use dates, dropdowns, multiple-selection dropdowns, open text, or supported combinations of dropdowns and open text.
• Scoring: assign a score to a question and a multiplier to each answer option.
• Conditional questions: display additional questions when a recipient selects a particular answer.
• Warning messages: display guidance based on the selected answer.

For supplier assessments, group suppliers according to the information you need from them before creating your questionnaires. For example, SaaS suppliers and consulting suppliers may need different questions.

Keep questionnaires focused. Every question you ask creates work for both the recipient and the assessor.

Use conditional questions to avoid asking for information that does not apply. For example, ask, “Do you handle personally identifiable information (PII)?” and display the related questions only when the recipient answers Yes.

Scoring can help you identify responses that need attention. Define what higher and lower scores mean, and apply that interpretation consistently throughout the questionnaire.

You can also use an LLM to help draft a questionnaire. Upload the empty CSV template and provide a prompt such as:

“Create a 10-question questionnaire for assessing SaaS suppliers in the eramba Online Assessment module. Use the attached CSV template and follow its instructions. Include relevant security and compliance questions, using dropdowns where appropriate.”

Review the questions and validate the generated file before importing it.

OA Portal

The OA Portal is the website that your OA recipients will access to respond to your questions. Every OA you send out has an associated questionnaire; this is what is shown on the portal.

The portal allows recipients to answer questions (which are saved automatically as they are answered), download a report (optional, depending on the OA settings), and submit once ready (the administrator can configure whether this is only possible after all or some questions are answered). The questions shown are derived from your questionnaire settings and can include a multitude of different question types. The recipient can also add attachments if allowed.

Feedback

eramba built in AI agent or MCP clients can easily go over the answers and provide an automated response to your Online Assessments.

The Feedback tab contains the answers provided by assessment recipients. Assessors can review these answers through the Main portal or the OA portal.

To focus on a particular assessment, locate it in the Online Assessments list and use its Feedback shortcut. This filters the feedback to the assessment you selected.

The AI and automation options described later in this course can help analyse responses. Define whether you want them to summarise answers, suggest conclusions, or update particular fields.

Understanding OA Statistics

The Online Assessments list includes columns showing the recipient’s progress, assessment scores, and the assessor’s review progress.

• Missing Answer: The percentage of currently visible questions that have not been answered. Questions hidden by conditional rules are excluded.
• Score: The score accumulated from answers to currently visible questions.
• Total Max Score: The highest achievable score for the questionnaire, taking its conditional question paths into account.
• Conditional Max Score: The maximum score based on the answers already provided and the questions currently visible. Completed answers contribute their actual calculated scores, while unanswered visible questions contribute their maximum possible scores. This value can change as answers reveal additional questions.
• Reviewed: The percentage of currently visible questions marked as reviewed by the assessor. It shows completed reviews, not outstanding reviews.

For example, a questionnaire may contain 100 questions, but conditional rules show only 10. If the recipient answers eight, Missing Answer is 20%. If the assessor marks five of those ten questions as reviewed, Reviewed is 50%.

OA Review

After a recipient submits an assessment, its status changes to Pending Review. The assessor must review the answers and record a conclusion.

Open the assessment’s feedback and check each answer. The Reviewed column shows which answers have been reviewed; initially, they are marked Not Reviewed.

After reviewing an answer, mark it as Reviewed. You can also use bulk editing to update several answers together.

Once all answers have been reviewed, select the assessment in the Online Assessments list and click Review. Enter your review notes and review date, then save.

The assessment stores its Notes and Review Date. Review notes cannot be edited after the review is complete, so check them carefully before saving.

Findings

After you complete the review, you might want to document issues or gaps that were identified; we do that in the form of Findings. These findings are linked to the specific OA and, optionally, to one or more individual questions within that OA.

Findings have a Deadline (which can trigger automated notifications) and a Status that can be set to "Open" or "Closed"; this helps you effectively track and manage these findings. Once a Finding is set to "Closed," the "Closure Date" will be automatically updated to reflect that date.

Statuses

Before continuing, review the following common feature documentation: Dynamic Statuses

Online Assessments include predefined dynamic statuses that help you identify their current stage, such as Accepting Answers, Submitted, and Reviewed.

Use these statuses to see which assessments are awaiting responses or require action from the assessor.

Implementation

During implementation, you will complete an assessment from start to finish using a test recipient account. This lets you check the questionnaire, access settings, notifications, and review process before inviting real recipients.

Use email addresses you can access for the test recipient and assessor. Check notification recipients before starting the assessment so that test messages reach only the intended people.

Access Management

Before continuing, review the following common feature documentation: Access Management.

1. If this is a new eramba installation, complete the initial Admin account setup (Video), including its password and email address. Use an organisation-managed email address.
2. Create a group for your GRC team. Name it according to your department. (Video)
3. If you plan to assess suppliers, optionally create a group for their accounts, such as Suppliers or Vendors. (Video)
4. Create individual user accounts for the GRC team carrying out the implementation. (Video) Configure each account as follows:
   • Groups: assign the Admin group and the GRC group created in step 2.
   • Portals: enable the Main and Online Assessments portals.
   • Authentication: use local authentication unless you have already configured an external authentication method.
5. Create a test recipient account. (Video) Use it to test permissions and as a reference when configuring future recipient accounts. Configure it as follows:
   • Groups: assign No Permissions Allowed and, optionally, the supplier group created in step 3.
   • Portal: enable only the Online Assessment portal.
   • Authentication: leave authentication disabled if you intend to use magic-link access. Enable local authentication and set a password if you intend to test authenticated access.
   • Email: use an address whose inbox you can access so you can verify notification delivery.
6. Log out of the Admin account and continue using your individual GRC account.
7. Optionally configure SAML, Google OAuth, or LDAP authentication. (Documentation Access Management)
8. Enable the OA portal under System / Settings / Authentication.

At this stage, create only the accounts needed for implementation and testing. Optionally, prepare a template for creating future OA recipient accounts:

Questionnaire

Before continuing, review the following common feature documentation: CSV Import and OA Questionaires

Prepare your questionnaires as CSV files and import them into eramba. Use the web interface for individual corrections where needed. If you use an LLM to help prepare the CSV, review both the questions and the file structure before importing it.

1. Identify the groups you intend to assess, such as SaaS suppliers or departments within your organisation.
2. Prepare an appropriate questionnaire for each group using the CSV template.
3. Download CSV Template (Video)
4. Follow the CSV Imports documentation for formatting instructions, Import the questionnaires through Online Assessments / Questionnaires / Import. (Video)
5. Check the imported questions and their settings. If corrections are needed, edit them through the web interface. During this preparation stage, you can also delete the test questionnaire and import a corrected version

Set Up Basic Notifications

Before continuing, review the following common feature documentation: Notifications.

Enable the basic notifications that support the assessment process. These notifications are disabled by default and must be configured in the relevant module under Common Features / Notifications. (Video)

For each notification, check its recipients and adjust the subject and body. Make sure any portal link matches the intended recipient’s access method. During implementation, use your test recipient and GRC team accounts.

1. In the Online Assessments module, open Common Features / Notifications and enable the Warning notification "Online Assessment has been Initiated. Configure it to notify the recipient when the assessment starts.
2. In the Online Assessments module, open Common Features / Notifications and enable the Warning notification Online Assessment has been Submitted. Configure it to notify the assessor when the answers are ready for review.
3. In the Feedback module, open Common Features / Notifications and configure the Comments & Attachments notifications for the assessor and recipient. Check the recipients and portal links separately for each notification.

When you complete the test assessment in the following steps, confirm that:

• Starting the assessment sends the recipient an invitation.
• Submitting the assessment notifies the assessor.
• Adding a comment or attachment notifies the intended participants.
• Each email contains a working link to the appropriate portal.

Create Third Party (Optional)

Before continuing, review the following supporting module documentation: Business Units, Assets and Third Parties

1. Create a Third Party in the Organisation / Third Party module. Set its contact to the test account created earlier. (Video)
2. Optionally, you can create multiple custom fields to track down attributes such as Supplier Website, Risk Level, ISO 27001 Certified, Etc. (Video)

Create Test OA

It is recommended to first create a test OA to ensure you fully understand how the module works, in particular if you have enabled notifications.

1. Create an OA, paying particular attention to the following fields:
   • Assessor Contact: select your GRC group and confirm that your account belongs to it.
   • Recipient: select the test recipient account.
   • Authentication: choose the access method you intend to test. For authenticated access, make sure you have the test account’s password. We recommend using non-authenticated access through a magic link.
   • Submit Incomplete: enable this if you want to test submission without answering every question. Before using real recipients, also test the setting you intend to use in operation.
   • Questionnaire: select the questionnaire you prepared.
   • Timeline: set the Start Date and End Date to tomorrow.
   • Recurrence: leave recurrence disabled for this initial test.
   • Third Parties: the Third Party created on the previous step.
2. Start the assessment manually so you can test it immediately rather than waiting until tomorrow. You can also stop the assessment manually at any time. (Video)
3. Flush the notification email queue so you do not have to wait for the warning notification to trigger, then check the test recipient’s inbox for the invitation.
4. Access the OA as the Recipient. Complete and submit the assessment. Test the answer types, conditional questions, and any enabled comments or attachments.
5. Confirm that the assessor receives the submission notification, flush the notification email queue if you do not want to wait for the email to be processed.
6. Access the OA as the Assessor and make sure you can see supplier answers using the portal and the main eramba portal. (Video)
7. Review each answer in the OA portal and mark it as Reviewed, then select the assessment’s checkbox and click Review. Enter your assessment notes and review date, check them carefully, and save. (Video).

The test is complete when the recipient can access and submit the questionnaire, the assessor can review it, and the expected notifications reach the correct inboxes.

Record OA Result (Optional)

Before continuing, review the following common feature documentation: Customisations.

You may want to record an assessment result, such as Pass/Fail, or a risk level, such as High, Medium, or Low.

You can store the result on the assessment itself or on an associated record, such as a Third Party or Asset. You may also want to record the last assessment date and the next assessment date.

Use custom fields to capture the information your organisation needs:

1. Decide where each result should be stored: on the OA, on associated records, or on both. Create the required custom fields in the relevant modules. (VideoVideo 3:58)
2. Update your views to display the custom fields created in the previous step. (Video)Video 2:30
3. Optionally configure Dynamic Status rules to highlight records based on their custom field values. (Video)

Unless you configure automations, you must update these fields manually.

Feedback Findings (Optional)

Before continuing, review the Finding documentation

If an assessment identifies an issue or gap that requires follow-up, record it as a finding.

1. In the Findings module, create a finding and associate it with the assessment. Where relevant, link it to the specific questions that identified the issue. Describe what needs to be addressed, assign an owner, and set a deadline. (Video)
2. Optionally - configure Custom Fields, Dynamic Statuses, Notifications, Etc.

Use the finding’s status to track whether the issue remains open or has been closed.

Basic Module Configurations

Before continuing, review the following common feature documentation: User Interface and Customisations

Using your GRC account, apply the following configurations to each module used in your implementation, such as Online Assessments, Feedback, Findings, and Third Parties.

1. Adjust the form fields using Customisations.
2. Configure your default views and select useful columns:
   • Online Assessments: title, assessor, recipient, dates, and statuses.
   • Feedback: associated assessment, question, answer, and review status.
   • Findings: associated assessment, deadline, and status.
   • Third Parties: name, contact, and any assessment result fields you created.
3. Configure default views for other users.
4. Optionally pin useful system views.
5. Optionally create additional views for assessments awaiting responses, assessments pending review, and open findings.
6. Optionally configure Dynamic Status rules to highlight records requiring attention.
7. Optionally create a report showing assessment progress, results, and outstanding findings.
8. Optionally schedule the report using Notifications:
   • Recipients: select the appropriate GRC group.
   • Frequency: choose how often to send it.
   • Subject and body: explain what recipients should review.

Check the configured views and any reports using your test records. If scheduled reporting is enabled, confirm that emails reach the intended recipients.

Operational Steps Summary (Optional)

Repeat the test assessment until you are comfortable with the complete process. Confirm that access, questionnaires, notifications, and reviews work as expected before inviting real recipients.

For supplier assessments, follow this process:

1. Create or reuse the supplier’s recipient account. Use the permissions and authentication settings tested during implementation. If you configured a User Account Template, create the account through that template or ask the authorised team to do so. Enter the recipient’s actual email address.

2. Create or select the Third Party. Assign the supplier’s recipient account as its contact.
3. Create the assessment. Select the appropriate questionnaire, assign the assessor and recipient, and associate the assessment with the Third Party. Set the start and end dates and, if required, configure recurrence.
4. Start the assessment. Start it manually or allow it to start automatically on its configured Start Date. Confirm that the recipient receives the invitation.
5. Monitor progress. Track outstanding responses and approaching deadlines. Follow up with recipients who need assistance or have not submitted their assessment.
6. Review the submitted answers. Check the responses and supporting evidence, request clarification where needed, and mark each answer as reviewed.
7. Complete the OA review. Record your assessment conclusion and review date. Check your notes before saving, as they cannot be edited afterwards.
8. Record the results. If you configured result fields on the OA or Third Party, update them to reflect your conclusion.
9. Follow up on findings. Where issues require action, create findings with owners and deadlines. Monitor them until they are resolved and closed.
10. Plan the next assessment. Decide when the supplier should be assessed again. Use recurrence if configured, or record the next assessment date through your chosen process.

Advanced Configurations (Optional)

The standard implementation is enough to operate Online Assessments. This section shows how to combine common features to reduce manual work and identify records requiring attention.

Scenario

We will automate three key stages of an assessment:

• The creation of a Supplier and its related user accounts, this will be created one a new row is created on the spreadsheet Finance keeps with suppliers

• The creation of the Online assessment

• Once the OA has been "Submitted" by the Third Party, there will be an automatic revision of the Online Assessment using AI which will also update the Supplier Risk Level and last review Date on the Third Party

The example combines three features:

• Custom fields store supplier details, such as the Finance Supplier ID, address, and country.
• Automations periodically read the Finance list, identify new suppliers, and create their Third Party records and associated Online Assessments.

Prepare Supplier Fields

Before continuing, review the Customisations documentation.

Using your GRC account: (VideoVideo 1:20)

1. In the Third Party module, create fields to track down the Supplier: ISO Certification (Yes/No), Supplier Risk level (Dropdown) and last Review date fields:
2. Add these fields to your Third Party view.

Use the identifier assigned by Finance to match suppliers consistently. Do not rely on the supplier name alone.

Automation

Before continuing, review the Automations documentation.

Create Automation

Prepare and test three automations that: (VideoVideo 2:47)

1. Detects new items on the Finance team Google Sheet and creates in eramba an account for the Supplier and a Third Party
2. Detects a Third Party without OAs and creates one for them
3. Detects an OA has been submitted, runs the answers over AI (OpenAI) and completes the OA with a summary of the feedback and then updates the supplier automatically (Risk Level, Last Review Date)

Test the Process

Use fictional suppliers to check that: (VideoVideo 5:53)

1. Create a new Supplier on the Finance Sheet
2. Run the automation that creates suppliers in eramba (otherwise you need to wait up to 1 hour when the automation runs)
3. Check the Third Party has been created, an OA should have been automatically created for this Third Party
4. Respond the OA and Submit, this will trigger the automation that reviews feedback and updates the Third Party

Video Guides

Complete the initial Admin account setup

Set the Admin account password and email address on a new installation.

Create a GRC group

Create the group for the GRC team carrying out the implementation.

Create a supplier group

Optionally create a group for supplier accounts.

Create GRC accounts and sign in

Create an individual GRC account, log out of Admin and sign in with it.

Create a test recipient account

Create the account that will receive and answer the test assessment.

Download the questionnaire CSV template

Download the template used to prepare questionnaires.

Prepare and import an OA questionnaire

Prepare the CSV, including chapters, answer types, scoring and conditional questions, and import it through Online Assessments / Questionnaires / Import.

Other questionnaire tasks:

• Edit questionnaire questions through the web interface.
• Delete a test questionnaire and import a corrected version.

Set up basic OA notifications

Enable the initiated, submitted and comments & attachments notifications.

Create a Third Party and assign its contact

Create the supplier, assign the recipient account as its contact and optionally add custom fields.

Create and start an OA

Create the assessment, configure its settings and start it manually.

Answer an assessment as the recipient

Access the OA portal as the recipient, then complete and submit the assessment.

Access an assessment as the assessor

See the submitted answers through the Main portal and the OA portal.

Review answers and record the OA review

Mark answers as reviewed, individually or with bulk editing, and record the final review.

Record the OA result

Create a result custom field, show it in your view and highlight it with a Dynamic Status.

Create a finding

Create a finding and link it to the assessment and specific questions.

Other workflow tasks:

• Flush the notification email queue.

Prepare Supplier Fields for Advanced Automations

Create Automation

Test Advanced Automations Process

Enable the OA portal.

Understand OA statistics and scoring, using a worked example.