The risk register lists what could go wrong, how likely and how bad it is, and what you do about it. It is the starting point for choosing your controls.
How to add a risk
- Open Risks in the menu, then Add risk.
- Give the Risk a short name, for example "Ransomware on the file server", and add a Description, Category and Owner.
- Under Assessment, choose the Likelihood (Rare to Almost certain) and the Impact (Negligible to Severe). The score is likelihood times impact, from 1 to 25, and shows as Low, Medium, High or Critical.
- Under Treatment, choose the Treatment (Reduce, Accept, Transfer or Avoid), the Status (Open, In treatment, Accepted or Closed) and write the Treatment plan.
- Optionally set Likelihood after treatment and Impact after treatment to record the remaining risk, and a Next review date.
- Click Save risk. It gets a number such as R-7.
How to work with the register
- The Heat map shows open risks by likelihood and impact; it also appears on the Overview.
- Search, filter by status or category, and sort by highest score, reference, recently changed or next review.
- Link controls from the control's page (Risks it treats) and assets from the asset's page. A risk's page then shows the controls that treat it.
What members can do
Members see the register and can add risks they notice. Changing and deleting risks needs an owner or admin (or a custom role with that permission).
Tips
- Risks with a Next review date appear in Tasks as Risk review. When the date has passed, the risk's owner gets one reminder (or the owners and admins if no owner is set). Closed risks are left alone.
- Every change is recorded in the audit log and shown under History. Numbers are never reused.
- Package limits: Free 10 risks, Supplier 25, Professional and higher unlimited. The page shows how many you use.
- From the Supplier Ready package, Reports lets you download the risk register for Excel.