To take advantage of RiskKey's powerful category scheduling features, the project must be an "Audit Workflow." If your project is not currently set to an "Audit Workflow" this can be changed at any time through the "Settings" tab.

This is the way that scheduling works:

• Each category can be assigned an assessor and auditor - This allows segregation of duties by permitting one person to actually assess the severity of risk (the assessor) and another person to actually review the control objectives (the auditor). This does not have to match the actual person's job title. Its just a helpful way to distinguish in the RiskKey world.

• Once assigned, each category receives a date that must periodically be reviewed (ex: weekly, monthly, quarterly, annually, etc.)

• Each assessment and objective item must be reviewed each period to ensure that it is up to date to annotate any changes.