Raise and treat a risk
Not every risk arrives as a signal. When your team knows something the platform cannot see — a process weakness, a strategic bet, a dependency on one person — you raise it by hand with Create Risk.
Raising a risk
The form asks for a classification first: a risk domain (cyber security, third party, compliance, operational, business continuity, data privacy, financial, reputational, strategic, or AI/ML) and a category within it — the category list narrows to match the domain you picked. Then a title, a description, and the inherent scoring: severity and likelihood, each on a 1-to-5 scale, with a rationale field so the reasoning is recorded next to the numbers. The form previews the resulting score and its rating band — informational, low, medium, high, or critical — as you adjust the sliders.
You can also assign a risk owner and a technical owner, and tag the risk for filtering later.
A note at the bottom of the form states the consequence of saving plainly: new risks join the register for treatment tracking, and you add a quant profile to see exposure in dollars.
Editing in place
Opening a risk from the register slides out its detail drawer. The Overview tab is inline-editable: title, description, inherent and residual scoring with rationale, treatment, ownership, review cadence, and tags are all edited in place and auto-saved — there is no separate edit screen to hunt for. Editing also unlocks the residual scoring fields, so you can record where the risk stands after treatment, alongside the inherent picture.
Treatment plans
Every risk carries a treatment strategy: mitigate, accept, transfer, avoid, or pending decision. The strategy is the intent; the Treatment tab holds the plan that delivers it. There you create a plan of action with an owner, a due date, and an estimated cost, then break it into individual action items whose progress rolls up into a completion bar. Where the risk is quantified, the tab also shows what the remediation buys you — the projected return on completing the plan.
Choosing accept routes the risk through the Acceptances tab, where the acceptance is documented and approved rather than waved through. An accepted risk moves to Monitoring status — still on the register, still reviewed — and the Governance tab keeps oversight of acceptances across the portfolio.
Mitigating controls
A risk can carry links to the controls that mitigate it. Risks escalated from a control gap or an assessment finding arrive with those links already in place, and the mapped controls do real work downstream: their assurance feeds the control-effectiveness input when you quantify the risk in dollars.
Lifecycle statuses
The register's status vocabulary, in order:
- Draft — captured but not yet confirmed.
- Open — confirmed and active.
- Mitigating — treatment actions in progress.
- Monitoring — accepted or transferred, being watched.
- Closed — resolved, or accepted and closed out.
- Reopened — a previously closed risk has recurred.
Hand-raised risks are half the register. The other half arrives on its own. Continue to Promote from signals.