Survey Score Configuration

Overview

With the survey score feature, the value of risks based on survey answers can be calculated. Every assessment carries potential risks based on responses, impacting areas such as business operations, privacy, security, vendors, and compliance. These risks can vary in severity and must be identified, assessed, and managed effectively. Assigning values to risks and configuring scoring helps in understanding their impact, enabling better decision-making and mitigation strategies.

The survey score conveys the value of the risks associated with the responses of any given survey.

To configure the survey score, follow these steps:

1. Log in to your Data Governance Tool account. 

     

2.  From the hamburger menu present on the top left corner of the Dashboard, click on Survey 

   

3. Once on the Surveys page, disable the Distribution view.

   

4. Once the Distribution View has been disabled, click on Settings icon associated with the Survey of your requirement.

   

5. On the Settings page, click on Survey Score Configuration.

   

6. Here, on this page, you can configure the survey score

   

7. To configure the score, first click on the Add Rule.

   

8. On doing so, a new rule configuration will appear.

9. Each rule configuration will have the following fields:

   Category: Domain users can title the category of the rule based on their requirements. 

   Questions: The questions drop-down menu shows all the questions present in that survey

   

   Operations: There are seven main operations: Contains,Doesn't Contain, Empty, Not Empty, Equals, Greater Than, and Less Than.

   

• Contains: If the answer for a question contains or matches the query, the found score is used to calculate the final score for that question. If it does not, the not found score is applied.

  

  For Example: If the query is "encryption" and the answer is "We use end-to-end encryption for data security," the found score is applied because "encryption" is present.

• Doesn't Contain: If the answer does not contain any of the values in the query, the found score is used to calculate the final score. If the operation fails (i.e., the answer contains the query values), the not found score is applied.

  

  For example: If the query is "password sharing," and the answer is "We ensure passwords are confidential," the found score is applied because "password sharing" is not mentioned.

• Equals: For Equals, the answer must exactly match the query to use the found score for the final calculation.

  

  For Example: If the query is "Yes" for "Do you conduct regular data audits?" and the answer is exactly "Yes," the found score is applied.

• Empty: For Empty, if the answer is blank, the operation is successful, and the found score is applied. Any query text is ignored.

  

  For example: If the answer to "List your data retention policies" is blank, the found score is applied. The query text is ignored.

• Not Empty: For Not Empty, if the answer contains any value, the operation is successful, and the found score is applied. Query text is ignored.

  

  For Example, if the answer to "Do you have a privacy policy?" is "Yes, we have a detailed privacy policy," the found score is applied because the field is not empty.

• Greater Than: For Greater Than, the answer must be numerically greater than the query value to apply the found score.

  

  For example, if the query is "100" (representing the number of user records shared) and the answer is "150," the found score is applied since 150 is greater than 100.

• Less Than: For Less Than, the answer must be numerically less than the query value to apply the found score.

  

  For instance, if the query is "100" (indicating the number of data breaches reported) and the answer is "50," the found score is applied as 50 is less than 100.

  Match Count: The number of actual keywords in the answer that match with the rule configuration. This is only applicable to the Keyword Query . This is useful for checkbox, radio group, or dropdown question types with predefined choices. For example, we can query: Out of 5 choices, any 2 should match to determine the score.

  Weight: The weight of the risk as defined by the domain user. The weight value is multiplied by the Found Value if the query matches with value in survey answer, not Found Value if the query does not match with the value in the survey answer or by Null Value if there is no answer present for that survey question.

  Found Score: The score if the value of the query matches with the value in the survey answer.

  Currently, the Found Score values can be 10 (High risk), 5 (moderate risk), and 1 (low risk). If any other value is inserted in this field, Score will be calculated for entire survey, not for the individual question and it won't be auto categorized between High, Moderate or Low.

  The survey overall score can be visible in Distribution View / Distribution Details Screen.

  Not Found Score: The score if the value of the query does not match with the value in the survey answer. Currently, the Not Found Score values can be 10 (High risk), 5 (moderate risk), and 1 (low risk). If any other value is inserted in this field, the score will not be calculated.

  Data Empty Null Score: The score if there is no answer present for that survey question 

  Action: The rule can be deleted by clicking on the delete icon against that rule.

  Based on the scores calculated here, each survey answer will be categorised as High risk, Moderate risk and Low risk. The configured risk categories will be flagged on the View Answers page as shown below.

  Query: There are 3 possible queries; Boolean, Keyword and Range.Examples of each will be given below 

• Boolean Query: This query is used when the value of the Survey Answer is either True or False. The example below depicts a Boolean query.

  In this rule, which has been defined under the Privacy category, the value of the Query is "False", the Found Score is "5" and the Weight is "5", meaning that if the value found in the survey answer is "False", then the score of the Privacy risk will be 25; Weight x Found Score, 5 x 5. This question will be categorised as Moderate risk (as Found Score is 5) If the value in the survey answer is not "False" (as defined by the Query) then the score of the Privacy risk will be 5; Weight into Not Found Score, 5 x 1.  This question would be categorised as Low risk (as Not Found score is 1) If there is no value in the survey answer, then the score of the Privacy risk will be 15; Weight x Null Score, 5 x 3. 

• Keyword Query: This query is used when the values in the survey answers are in the form of multiple keywords. The example below depicts a Keyword Query 

  

  In this rule, the values of the Query are -- "clear opt-out options, Data Security and Control over data usage". The Match Count is "2", the Weight score is "4" and the Found score is "10". This means that if any 2 (Match Count) of the Query values are found in the survey answer, then the score of the Privacy risk will be 40; Weight x Found Score, 4 x 10. In the case that only less than 2 values found in the survey answer match the query, then the privacy risk score will be 4; Weight x Not Found Score, 4 x 1.  If there are no values in the survey answer, then the score of the Privacy risk will be 4; Weight x Null Score, 4 x 1. 

• Range Query:This query is used to define a numerical range when the values in the survey answers are numbers. The example below depicts a Range Query:

  In this example, the risk category is Security.In this rule, the value of the Query is > 50, the Found Score is 5 and the Weight is 4, meaning that if the value found in the survey answer is greater than 50, then the score of the Security risk will be 20; Weight x Found Score, 4 x 5. If the value in the survey answer is less than or equal to 50, the Security risk will be 4; Weight x Not Found Score, 4 x 1. 

  If there is no value in the survey answer, then the Security Risk will be 0; Weight x Null Score; 4 x 0 The range query can include different conditions, examples are  Less than: <50   Greater than: >50   Less than or equal to: <=50  Greater than or equal to: >=50  And conditional: >=50 and <=60   Or conditional: <=50 or >=60 

  Note: The operation should always precede the number

  Note: Scores can be configured in negative digits and decimal points.

10. To copy/recreate an existing rule, click on the rule you want to copy and then the Duplicate Rule button. This will create another version of the selected rule. Changes can be made to this version as required.

    

11. After making any changes/modifications to the rule, the Revert Scores button can be used to bring back the previously calculated scores (the scores before the latest changes were made). However,this only brings the last score, it cannot be used to bring back any scores before the last score

12. Once the rules have been configured, click on the Save Configuration button.

13. To calculate scores for all questions, click on the "Calculate scores for All answers" button. This processes the responses,applies the configured scoring logic, and updates the results accordingly. It ensures that all questions are evaluated based on the predefined criteria, providing accurate risk assessment.

    

14. To calculate scores for the latest answers, click on the "Calculate Scores For Latest Answers" button. This processes only the most recent responses, applying the scoring logic to update the results accordingly.

    

    Note: Score calculation is handled as a backend job (WebJob) that runs on a scheduled interval, automatically computing scores for all groups associated with a specific survey.

15. Once the scores have been generated, the following message will appear

    

16. Generate Rules: This feature is used for those questions with the multiple answer options like Checkbox and Radio group question types. Creating new rules for each option can be take up significant time. By clicking on this button, the Generate Rules box will appear. From the Question drop-down, select the required Checkbox, Radio Group or Drop-down question. Enter the Category and then click Generate

    On doing so, Rules for each answer option will appear on the configuration screen. The Query value will be automatically entered based on each answer option configured while creating the survey. The Found/Not Found, Match Count and Weight values can be specified here as needed.

17. Clear Unsaved Rules: Click on this button to remove any rule that has not been saved yet. Rules can be saved by clicking the Save Configuration button. If rules are created and not saved, then on clicking the Clear Unsaved Rules button, then these rules will be removed.

    

Viewing the survey scores

The scores of each question (of the latest survey version, i.e., the last response received) are summed up and this total value can be found displayed in 3 locations:

Note: If the risk score config is already available, then the score will get automatically calculated and displayed in these locations any time a new answer is submitted.

1. On the Survey section of the user's dashboard, under the View Answers tab.

   

2. On the Surveys page when the Distribution view has been enabled.

   

3. On the Distribution Details tab of the Analyze page.

4. Whenever a new answer is submitted, the risk categories on the View Answer screen also change according to the configuration applicable. Based on the risk score, risk registers (if configured) are mapped to the survey answers.