Skip to main content

Risks

The risk register is where everything the platform observes comes together as decisions. Risks arrive two ways: your team raises them by hand, and the rest of SolveGRC sends them in. Cloud posture failures arrive as signals. Vendor escalations come from TPRM. You can escalate a control gap from an assessment, using the escalate button on a control marked Not Compliant or Likely Not Compliant. Control-assurance drift is picked up automatically. Each risk carries a lifecycle status, an owner, a treatment plan and, where you add a quantification profile, a dollar exposure figure with an explainable breakdown.

Risks opens on Overview, which shows priorities and a compact posture summary. The Workspace navigation directly below the Risks heading shows all five destinations. The current destination is highlighted and underlined:

  • Overview: pending intake, review priorities and current posture.
  • Register: search, filter and page through all risks you can read. On desktop, the selected risk stays beside the list. Open its full workspace for more room; returning restores the Register context.
  • Inbox: select Signals, AI suggestions or Acceptance decisions. One queue appears at a time.
  • Treatment: plans of action and upcoming treatment work.
  • Insights: choose one analysis, including portfolio, trends, scenarios, insurance, governance, policy gaps and correlation.

Use Create risk in the header to capture a risk. Export offers the current Register filters or the full authorized register, including results beyond the visible page. Settings, help and exports remain header utilities. Overview counts describe the authorized portfolio rather than the current Register page. Current residual exposure is reported separately from inherent severity; a missing residual assessment remains unknown.

The lifecycle at a glance​

  1. Raise and treat. Create a risk, classify it, score it, and plan its treatment.
  2. Promote from signals. Turn what the platform observes — findings, gaps, escalations — into register entries with their provenance intact.
  3. Quantify in dollars. Add a quant profile so a risk reads as a dollar range, not just a color.

The register uses six statuses: Draft, Open, Mitigating, Monitoring, Closed, and Reopened. New risks start as Draft and Not assessed until you explicitly record both severity and likelihood. In the current UI, only acceptances change a risk's status. Approving an acceptance moves the risk to Monitoring, and revoking it moves the risk back to Open. There is no manual status control, and nothing currently sets Mitigating. Each risk also carries a review date. Overview identifies overdue reviews.

How this connects​

The register consumes from most of the platform and feeds the layers above it:

  • In: risks you raise, cloud posture failures that arrive as signals, vendor risk escalations from TPRM, control gaps escalated from assessments, and control-assurance drift.
  • Out: the risk register with treatment plans, and quantified exposure in dollars where profiled.
  • Feeds: executive reporting and board-level portfolio views.

SolveGRC estimates an annual loss for each open risk on its own every 15 minutes. For a full dollar range, click Run Simulation on the risk's Financial exposure section.

Before you start​

The register is only as rich as its inputs

You can run the register entirely by hand, but its value compounds when the rest of the platform feeds it. Connected cloud accounts, active vendor assessments, and activated frameworks all generate the signals that keep the register honest about what is actually happening.

You will also need:

  • Access to the module. Risks appears in the sidebar only if your role has read permission for it, and creating risks or acceptances needs create permission. If you do not see it, ask an administrator.
  • An active subscription. Your workspace needs an active subscription to use the module.

If you are new to the module, the page header offers a guided tour, Track and treat a risk, that walks through creating, classifying, linking, and treating a risk in place.