In Tenacy, completing an action is not a trivial step: it can implement a measure, close a gap, resolve an incident, an exemption or a project, and shift your compliance scores.
To gain more control, you can enable the action review through the action.review preference: only your pilots will then be able to complete actions, and therefore apply their impacts.
This article describes the full path once the preference is enabled. To find out whether this preference is relevant for your organization, see the article dedicated to the activation decision.
💡 This article describes the behavior when the action.review preference is enabled. If it is disabled, a contributor moves their actions to "Finished" directly and their impacts apply immediately, without going through a review.
The "To review" status, on the contributor side
When the preference is enabled, a contributor can no longer move an action to "Done". The "Done" button is greyed out and not clickable, and a message on hover indicates that validation is reserved for the pilot.
The contributor therefore moves their action to the "To review" status, which signals that it is ready to be checked.
When the action moves to "To review", any subtasks of the action are automatically completed. Conversely, completing all subtasks of an action moves it to "To review".
Being notified of actions to review, on the pilot side
When an action moves to "To review", all root pilots as well as the relevant local pilots according to their perimeters receive a notification through the notification icon. A badge indicates the number of actions waiting to be reviewed.
By clicking this icon, the pilot is redirected to a filtered view listing all actions with the "To review" status. This view is a redirection to the "All actions" register with the usual filters available (perimeter, priority, owner, action type, etc.), to find the actions to review that concern them.
💡 On high-volume accounts, these filters allow several pilots to easily split the review workload, each handling for example the actions of their perimeter.
Reviewing the impacts before validating
Before validating, the pilot can check what closing the action will produce. A "Links" tab appears in the action's side panel as soon as an object is associated with it.
This tab lists the objects linked to the action. By clicking on one of them, the pilot is redirected to the corresponding module: for example the Security base for a measure, or Projects security for a project. They can thus check each impact before deciding.
The possible impacts of completing an action are: implementing a measure, improving the efficiency of a measure, closing a gap, resolving an incident, closing a exemption, closing a project.
⚠️ Not all linked objects are necessarily closed when the action is completed. A gap associated with several actions, for example, only closes once its last handling action is validated.
Validating the action
To validate, the pilot moves the action to "Finished". A confirmation pop-up then summarizes the impacts that will apply, so that they confirm with full knowledge of the situation.
Once the validation is confirmed, the impacts are applied: the measure is implemented or improved, the gap is closed, the incident, the exemption or the project is resolved, and the relevant scores are updated.
A day with the action review
To make the process more concrete, here is how it unfolds on the contributor side and on the pilot side.
Monday, 9:00 AM. Claire, a contributor, has completed her action "Encryption of backups". The "Finished" button is greyed out, a message reminds her that validation is up to the pilot. She therefore moves the action to "To review", and its subtasks are automatically completed.
Monday, 10:00 AM. Rémi, a pilot, logs in. A badge on the notification icon indicates three actions to review. He clicks and lands directly on the dedicated filtered view.
Monday, 10:05 AM. Rémi opens Claire's action and looks at the "Links" tab: he sees that closing it will implement the measure TE019 and close the gap GAP034.
Monday, 10:08 AM. Rémi moves the action to "Finished". The pop-up summarizes the impacts, and he confirms. The measure is implemented, the gap is closed, and the scores are updated.
To better visualize the journey of an action to review on the contributor's and on the pilot's sides with the action.review preference activated, watch the video below:
Effect of the "To review" status on scores and progress
Measure scores: a "To review" action does not yet change the score. If it is an implementation action, the measure is not yet implemented as long as the action is "To review".
Action plan progress: a "To review" action is considered 100% completed and will therefore not impact your action plan progress percentage.
Indicators: a "To review" action is counted as "In progress" in the indicators. Enabling the review preference also activates indicators specific to this status.
Points of attention
Reopening an already closed action is not handled for now. An action that moves back to "To review" after having been "Finished" reappears in the filtered view, but without associated impacts.
Regarding the JIRA connector: when the action.review preference is enabled, closing an action on the Jira side moves the corresponding action to "To review" in Tenacy (and not "Finished"). Its impacts will only apply after validation by a pilot in Tenacy.
🔎 To find out whether enabling the review preference is relevant for your organization, see the article on the action review activation decision.