About risk-based task expiry
For products that use a risk model, you can configure different task expiry periods for each product application risk level. When the task is passed on a product application, it remains valid for the number of days specified for the product application's risk level, then it expires. The expiry period must be at least 60 days.
For example, you could set an expiry period of 365 days for low risk product applications, 120 days for medium risk, and 60 days for high risk. This means high risk product applications must be successfully re-verified more frequently than medium and low risk profiles.
When the task expires, product applications using the task that are in an Approved state change to In review. This ensures you re-evaluate tasks at intervals that suit their risk level.
A profile may have multiple product applications that require the task. If the product applications have different risk levels, the task expires according to the shortest expiry period of each risk level.
When a product isn't using the risk-based expiry configuration option, the task uses the default expiry period, if one is set.
How changes to risk level affect task expiry
If the risk level for the product application changes at any point, or if you change the task expiry period for a risk level, Maxsight resets the expiry period for existing tasks to the new risk-level expiry period or retains the period of the previous risk level, whichever is shorter, to avoid missed task expiry dates.
For example, let's say you set a task to expire every 60 days for high risk and every 120 days for medium risk product applications. The task is then added to a high risk product application and is passed on the same day. The task is therefore due to expire in 60 days from this day. Ten days after the task is passed, the risk level of the product application changes to medium. Maxsight now applies the shorter of the two expiry periods, which in this example is the high risk level expiry period of 60 days, meaning the task is still due to expire in 50 days. When the task expires in 50 days and the risk level is still medium, then the new task version expires in 120 days from the day the new task version is passed.