Raise and treat a risk
Not every risk arrives as a signal. When your team knows something the platform cannot see — a process weakness, a strategic bet, a dependency on one person — you raise it by hand with Create Risk.
Raising a risk
The form asks for a classification first: a risk domain (cyber security, third party, compliance, operational, business continuity, data privacy, financial, reputational, strategic, or AI/ML) and a category within it — the category list narrows to match the domain you picked. Then a title, a description. Inherent scoring is optional at creation: severity and likelihood, each on a 1-to-5 scale, with a rationale field so the reasoning is recorded next to the numbers. Choose Set severity and Set likelihood to assess the risk. Both values are required for an assessment; otherwise the risk remains Not assessed. The form previews the resulting score and its rating band — informational, low, medium, high, or critical — as you adjust the sliders. The title needs at least 5 characters. Risk Domain and Risk Category cannot be changed after the first save.
You can also assign a risk owner and a technical owner, and tag the risk for filtering later.
A note at the bottom of the form states the consequence of saving plainly: new risks join the register for treatment tracking, and you add a quant profile to see exposure in dollars.
Editing in place
Opening a risk in Register keeps the list beside its record on desktop. On smaller screens, the selected record uses the available width. Open full workspace provides a dedicated record view.
The Assessment section shows saved scores and rationale, treatment, ownership and review details. Choose Edit assessment or Edit risk to open the shared edit form. Saving persists treatment strategy, target residual rating and treatment notes along with the rest of the record; cancelling leaves the saved values unchanged.
Creating a risk records only any inherent scoring you explicitly supplied. To record exposure after treatment, use the edit form's residual Severity and Likelihood fields. Assessment also holds Impacted Business Services, used by financial derivation.
Treatment plans
Every risk carries a treatment strategy: mitigate, accept, transfer, avoid, or pending decision. The strategy is the intent; the Treatment section holds the plan that delivers it. There you create a plan of action with an owner, a due date, and an estimated cost, then break it into individual action items whose progress rolls up into a completion bar. Where the risk is quantified, the section also shows what the remediation buys you — the projected return on completing the plan.
To accept a risk, click Create Acceptance on the Inbox > Acceptance decisions queue, where the acceptance is documented and approved rather than waved through. Draft risks do not appear in its list. When the acceptance is approved, the risk's strategy becomes Accept and its status becomes Monitoring. The risk stays on the register and is still reviewed. Revoking the acceptance moves the risk back to Open. The Insights > Governance view keeps oversight of acceptances across the portfolio.
Mitigating controls
A risk can carry links to the controls that mitigate it. When a risk carries mapped controls, their assurance feeds the control-effectiveness input when you quantify the risk in dollars. Creating a risk, or creating or linking one from a signal, does not add controls to it.
Lifecycle statuses
The register's status vocabulary, in order:
- Draft — captured but not yet confirmed. New risks start here.
- Open — confirmed and active.
- Mitigating — treatment actions in progress. Nothing currently sets this status.
- Monitoring — accepted, being watched. Approving an acceptance sets this status.
- Closed — resolved, or accepted and closed out.
- Reopened — a previously closed risk has recurred.
You cannot change a risk's status by hand. In the current UI, only approving an acceptance (to Monitoring) and revoking it (back to Open) change a risk's status.
Hand-raised risks are half the register. The other half arrives on its own. Continue to Promote from signals.