Skip to main content

Add a risk to the risk register

Where: Dashboard → Risk Management → Risk Register, or open Risk Register.

Who: admins, or members whose department has access to the Risk Register module.

You can also pick ready-made risks from the library instead of writing your own. See Use the risk library.

1. Create the risk scenario​

  1. Open Risk Register and click Add Scenario.
  2. In Add Risk Scenario, fill in:
    • Description: pick one or write a custom description.
    • Category
    • Internal Risk ID (optional): letters, numbers, dots and hyphens only.
    • Departments
    • Likelihood and Impact
    • CIA Category (Optional): confidentiality, integrity or availability.
    • Notes
  3. Click Create Risk Scenario.

To add many risks at once, click Import, download the template ("Click here to download the template"), fill it in and upload it (Excel or CSV).

2. Assess the risk​

Open the risk from the register and go to the Assessment tab:

  1. Under Inherent Risk, set the likelihood (the chance of the risk happening before any protection) and the impact (how bad it could be).
  2. Under Residual Risk, set the likelihood and impact after your protections are in place. Residual risk should not be higher than inherent risk.
  3. Under Treatment plan, choose the treatment type and add Treatment details.
  4. Click Add Control → Select Controls to link the controls that mitigate this risk. New controls are created on the Controls page.

The Assessment progress banner shows how far along you are. The assessment can't start until inherent risk, residual risk and treatment type are set.

3. Assign an owner and approve​

  1. Click Assign Owner, choose the owner and click Save.
  2. Click Approve, then Continue with approval in Approve Risk Scenario. By approving you accept the risk evaluation and the treatment plan.

The risk's status moves from NEEDS REVIEW to IN PROGRESS and finally APPROVED.

Good to know​

  • The treatment is COMPLETED only when its linked controls pass. Otherwise it shows INCOMPLETE, and Treatment Incomplete Reasons lists why.
  • Marking a linked control out of scope unlinks it from the risk, which can make the treatment incomplete again.
  • Click Take Snapshot on the register to save a copy of it as it stands today. See Risk register snapshots.
  • To remove a risk, open it and click Delete. This also deletes its assessment and treatment plan.