Risks
Create and rate risks, link the controls that treat them, and read the heatmap.
10 min read9 sectionsAll roles (archive, delete and direct control linking are owners and admins only)
The Risks register is where you record what could go wrong, rate it by likelihood and impact, and track how well your controls bring it down. Use it to add and review risks, read the heatmap, and see which risks sit above your organisation's tolerance.
Open Risks from the sidebar to see every risk you have access to, one row each.
Register columns
- Risk ID
The risk's key, tinted in the colour of its current rating.
- Risk Title
Shows an Archived or Deleted badge when you are viewing those lists.
- Category
Your organisation's risk category. An Over tolerance chip appears when the risk is rated above its category's tolerance.
- Inherent Score
The rating before controls, in your organisation's severity labels.
- Residual Score
The rating after controls, or a dash if no residual assessment exists yet.
- Owner
The person accountable for the risk.
- Classification
Public, Confidential or Highly sensitive. See Sensitivity and sharing.
- Shared
The other business units this risk is also visible to.
- Treatment Plan / Treatment Due Date
A linked treatment plan and when it is due.
Each row ends with Details (expands the row with the risk statement, current controls and their effectiveness, scoring and review dates), View (opens the risk's own page) and Propose Update.
Narrow the register to the risks you care about, then export exactly what you see.
Search matches the risk key, title, owner and category. Beside it you can filter by business unit (when you can see more than one), Status and Category (choosing a top-level category includes its subcategories). Saved views give one-click presets: High+ Open (status Open with likelihood and impact both at level 4 or above), Mitigating and All Risks. Click a filter chip to remove it, or Clear all.
Residual / Inherent
Switches which rating colours the Risk ID and drives the heatmap.
Business unit / Enterprise
Enterprise rolls risks up to one row per top-level category, rated at its worst residual risk. Expand a row to see subcategories.
Over tolerance
Shows only risks rated above their category's tolerance. Disabled until your organisation sets tolerances.
Archived / Trash
Switch to archived risks, or to deleted risks waiting to be purged.
Export CSV downloads the rows currently shown, including linked records (linked controls carry their effectiveness rating). Download PDF opens a print-ready risk register in a new window; choose Save as PDF in the print dialog. The document is A4 landscape: if the dialog previews portrait, set Layout to Landscape and keep Margins at Default. If nothing opens, allow pop-ups for the site.
The 5 × 5 grid on the register counts the risks that match your current filters in each likelihood and impact cell.
Rows are likelihood and columns are impact, labelled with your organisation's own scale words. Each cell is coloured by the severity band it falls in, and the legend lists every band with its score range. Use the Residual / Inherent toggle above the grid to switch basis. In the residual view, a risk with no residual assessment is plotted at its inherent cell.
- 1
Click a cell
A dialog lists the risks in that cell with their key, title, owner, category and score.
- 2
Filter from the inherent view
In the Inherent view, clicking a cell also filters the register to that likelihood and impact. Remove the Likelihood and Impact chips to go back.
A rating comes from a likelihood and an impact, each on a 1–5 scale, turned into a band by your organisation's settings.
The score is likelihood × impact (1–25). The band is decided by the cell, not the score alone: your organisation's severity bands set the score ranges, and an owner or admin can override individual cells. So a 3 × 4 and a 4 × 3 can carry different ratings.
Inherent is the rating before any controls. Residual is your judgement of what remains once controls are working. The residual score cannot be higher than the inherent score.
Default severity bands (your organisation may have renamed or re-cut them)
- Low
Scores 1–8.
- Medium
Scores 9–14.
- High
Scores 15–19.
- Critical
Scores 20–25, or 20–23 on a five-band scale.
- Extreme
Five-band scale only: scores 24–25.
Severity Labels
Band names, score ranges and cell overrides.
Likelihood & Impact Scales
The words for each level (defaults Rare to Almost Certain, Negligible to Severe).
Category Risk Tolerance
The highest band each top-level category accepts.
Control Effectiveness Scale
The ratings used on linked controls.
New risks are proposals: nothing reaches the register until an owner or admin approves it.
- 1
Click New in the top bar
If the form opens on another type, click Risk in the row of types at the top.
- 2
Fill in the form
The assistant panel on the right can suggest wording and fill fields for you.
- 3
Click Submit (propose), then Submit to Queue
You are taken to the new proposal. The risk starts with status Open once approved. See the Proposals guide.
The risk form, in order
- Title
A short name for the risk.
- Organisational Unit
The unit that owns the risk. Defaults to your root unit.
- Also visible to
Other units that can see the risk. Owners and admins only.
- Likelihood / Impact
The inherent rating. Both start at level 3.
- Category
A category, then optionally a subcategory, from your risk taxonomy.
- Owner
A member of your team.
- Risk Statement / Causes / Consequences
What the risk is, why it could happen and its effect.
- Next Review Date
When the risk should next be reviewed.
- Classification
Public, Confidential or Highly sensitive.
- Inherent Risk Rating
Calculated from likelihood and impact.
- Linked Controls (Optional)
Add controls and rate how effective each is for this risk.
- Residual Likelihood / Residual Impact
Optional. Shows the residual severity once both are set.
- Linked Obligations, Evidence, Incidents, Treatment Plans, Policies
Optional links to existing records.
- Additional Information (optional)
Notes for the reviewer.
Every edit goes through Propose Update and waits for approval.
Click Propose Update on a register row or on the risk's page. The edit form has the same risk fields as the create form, plus Status. Click Submit Update (propose). On the risk's page, Add Assessment in the Risk Assessment card opens the same form when no residual rating exists yet. To remove a residual assessment, set both residual fields back to None.
Risk status (does not change the rating)
- Open
On the register and being monitored, but no treatment is underway yet.
- Mitigating
Treatment is in progress: controls or a treatment plan are being implemented.
- Closed
No longer actively managed: treated to an acceptable level, or no longer applicable.
Controls carry an effectiveness rating for each risk they are linked to; other links are plain.
On a risk's page, the Linked Controls card lists each control with its effectiveness for this risk. Owners and admins can change a rating from the dropdown, remove a link with the X, or add one with Link a control (search by key or title; new links start as Not rated). These changes apply straight away, without a proposal. Members see the card read-only and can change links through Propose Update.
Default effectiveness ratings
- Effective
Well designed and operating reliably.
- Partially Effective
Works, but with gaps. New links added in a form start here, so check it.
- Ineffective
Not reducing the risk as intended.
Linked obligations, evidence, incidents, treatment plans and policies show on the risk's page as read-only lists. Change them with Propose Update, or link from the other record. The Controls guide covers the control side.
Classification controls who can read a risk; sharing controls which units can see it.
Classification
- Public
Visible to everyone who can see the risk's business unit.
- Confidential
Visible only to people granted Confidential access.
- Highly sensitive
Visible only to the people named under Restricted to. For a very small number of cases.
Also visible to shares a risk with other business units. Those units can view and link to it, but only the owning unit can edit it. Opening a risk shared into your unit shows Make your own, which opens the New form pre-filled with a copy for your unit to propose.
Owners and admins can take a risk out of the register in three steps of increasing finality.
- 1
Archive
On the risk's page, click Archive. It leaves the register and search but nothing is deleted. To bring it back, switch the register to Archived, open the risk and click Restore.
- 2
Move to trash
Click Delete (or Move to trash on an archived risk). The risk is hidden from the register, search and AI answers, and is purged on the date shown (30 days by default). Restore it from Trash until then.
- 3
Delete permanently
On a trashed risk, Delete permanently removes it and its links now. Only an audit snapshot remains.