Skip to main content

Promote from signals

The register's second intake is the signal queue. Some parts of the platform raise a risk signal on their own when they observe something risk-shaped, others raise one when you escalate, and the signals land in a triage queue in Inbox > Signals. Search and signal-type filters apply to the whole pending queue. Use Previous and Next to reach signals beyond the first page; the displayed total is the full matching pending count.

Where signals come from​

Each signal card names its type, and the types map to the platform's observation surfaces:

  • Finding — from a vendor assessment in TPRM.
  • Assessment gap — a gap identified in a compliance assessment.
  • Control Failure — a failing cloud posture check on a mapped control. It is raised automatically when the finding is critical or high severity, the control is linked to a policy, or the affected asset's business service is critical or high. Its title starts with "Security posture gap", "Compliance posture gap", or "Policy vs configuration gap".
  • External Signal — threat intelligence, news, or OSINT drift collected by vendor monitoring. Contract coverage gaps from TPRM also arrive with this type.
  • Questionnaire — a risk surfaced by an answer, including gaps sent with Escalate N Gaps to Risk.
  • Evidence gap — evidence that is missing or has expired.
  • Manual Entry and AI detected — signals raised by a person or flagged by the platform's own analysis. A vendor escalated with Escalate to Risk arrives as Manual Entry.

Alongside its type, a signal carries its origin (system, user, AI, or external), a severity, a confidence score, and a reference back to the source record in the module that raised it.

Triaging the queue​

Each card shows its source and reference, received time, severity and likelihood, confidence, description and evidence context before its actions. Missing context is stated explicitly. Retained influence reflects recorded decay where available; received time alone does not certify fresh evidence.

Each signal offers Correlate, Link to risk, and Create risk:

  • Correlate looks for an existing risk the signal belongs to. A match scoring 70% or more links the signal to that risk; otherwise the signal stays in the queue for you to link or create. SolveGRC also runs this matching on its own every five minutes for signals still in the queue, against any risk that isn't closed, including a Draft one.
  • Link to risk attaches the signal to a risk you choose. The list offers only risks that are Open, Mitigating, or Monitoring.
  • Create risk opens Create Risk from Signal, pre-filled with the signal's title, domain, category, severity, and likelihood. The new risk starts as Draft.

Linking rather than always creating matters: five signals pointing at one risk is a sharper register than five near-duplicate risks.

Escalations from other modules​

You do not have to wait for the queue. Vendor pages and findings in TPRM carry an Escalate to Risk action, and a control card in Assessments offers the same for a control marked Not Compliant or Likely Not Compliant. The escalation dialog opens pre-filled with the source's severity and suggested domain, and lets you adjust both before it emits the signal. In Generate Findings from Gaps, Critical and High gaps come with Escalate to Risk already ticked.

TPRM also has a direct path that skips the queue: Send to risk register on the TPRM dashboard's Top Risky Vendors card creates or refreshes register risks for your top 10 vendors.

When a vendor's questionnaire answer is weak on a control where your own program also has a gap, SolveGRC opens a Draft risk titled "Third-party posture gaps: vendor" and links the signal to it. Once either gap is resolved, it archives the signal and closes that risk if it is still a draft.

Cloud posture feeds the queue on its own through Control Failure signals, described above. You create or link the risk, and add its dollar figures on the risk's Financial exposure section. A later sync that sees the fix closes the finding on the control, but does not change the signal or the risk.

What provenance travels with a promoted risk​

A promoted risk remembers where it came from

Once a signal is linked to a risk, with Link or Auto-Correlate, the risk's Inbox > Signals queue lists it: the signal's type, severity, correlation score, source module, source reference, and whether it has been processed. The register records not just that the risk exists, but why.

Once a risk is on the register, the next question is what it costs. Continue to Quantify in dollars.