Treatment Plans
Plan, track and close out the remediation work that brings a risk back within tolerance.
8 min read8 sectionsAll roles (deleting a plan is owners and admins only)
A treatment plan is the remediation work that brings a risk back within tolerance: who does it, by when, and why. Use the Treatment Plans register to create plans, link them to the risks and incidents they address, and keep track of what is running late.
A plan records a piece of remediation work and ties it to the records it addresses.
Plans are usually linked to one or more risks, but they can also be linked to incidents, controls, obligations, evidence and policies, or to nothing at all. A plan linked to risks inherits a rating from the highest-rated of those risks, shown in your organisation's severity labels.
Plans reach the register two ways: you create one yourself, or you are prompted for one while creating a risk whose residual rating is high enough. See When a new risk prompts for a plan.
Open Treatment Plans from the sidebar to see every plan you have access to.
Register columns
- ID
The plan's key, tinted by its status.
- Title
What the work is.
- Rating
The rating inherited from the highest-rated linked risk, or a dash when no risk is linked.
- Status
- Classification
Public, Confidential or Highly sensitive.
- Privilege
Marked only when the plan is Privileged.
- Shared
Other business units the plan is also visible to.
- Owner
Who is accountable for the work.
- Due Date
Shown in red when the plan is overdue.
- Links
One chip per kind of linked record, such as 2 Risks. Click a chip to open that register filtered to this plan.
- Actions
View and Propose Update. Clicking anywhere else on the row also opens the plan.
Search by title, description, owner or ID. Filter by business unit (when you can see more than one), by status, and by rating, which uses the same inherited rating as the Rating column.
A new plan is a proposal. It appears in the register once an owner or admin approves it.
- 1
Click New Treatment Plan
On the register toolbar. You can also use New in the top bar and click Treatment Plan in the row of types.
- 2
Fill in the form
The assistant panel on the right can suggest wording and fill fields for you.
- 3
Click Submit (propose), then Submit to Queue
You are taken to the new proposal. See the Proposals guide.
The treatment plan form, in order
- Title
A short name for the work.
- Organisational Unit
The unit that owns the plan. Defaults to your root unit.
- Also visible to
Other units that can see the plan. Owners and admins only.
- Status
Starts at Not Started.
- Priority
Low, Medium, High or Critical. Starts at Medium and shows on the plan's own page.
- Owner
A member of your team.
- Due Date
When the work should be finished. Drives overdue tracking.
- Mitigating Actions
The discrete actions the risk owner will undertake to enhance the controls, one per line.
- Classification
Public, Confidential or Highly sensitive.
- Privilege
Non-privileged or Privileged.
- Linked Obligations, Risks, Controls, Evidence, Incidents, Policies
Optional links to existing records.
- Additional Information (optional)
Notes for the reviewer.
Creating a risk can open a treatment plan form straight away.
When you submit a new risk with a residual rating that meets your organisation's Treatment Plan Threshold, a Create Treatment Plan dialog opens. It asks for a title and due date (both required), plus description, owner, status, classification, privilege and mitigating actions. Click Create Treatment Plan to file it as a second proposal, or Skip; closing the dialog skips it too. Owners and admins set the threshold in Settings under Edit Tenant Configuration, on the Risk Appetite step.
The status you see is worked out from the status you record and the due date.
Status
- Not Started
Work has not begun.
- In Progress
Work is underway.
- Completed
Done. A completed plan is never shown as overdue.
- Overdue
Shown automatically once the due date passes on a plan that is not Completed. You can also set it yourself.
When the work is done, use Propose Update to set the status to Completed.
Open a plan to see everything about it in one place.
The top card shows the key, inherited rating, status, classification and privilege, then Owner, Due Date, Priority, Created, Business Unit, Also visible to and Restricted to. Below are the Mitigating Actions and Description, and a list for each kind of linked record: Linked Risks, Linked Controls, Linked Obligations, Linked Evidence, Linked Incidents and Linked Policies. Click any item to open it.
To add or remove links, use Propose Update and change the pickers under Entity Linkages. Links work both ways: a plan linked here also appears under Linked Treatment Plans on the risk's page. See the Risks guide.
Classification and privilege decide who can read a plan; sharing decides which units see it.
Classification
- Public
Visible to everyone who can see the plan's business unit.
- Confidential
Visible only to people granted Confidential access.
- Highly sensitive
Visible only to the people named under Restricted to. For a very small number of cases.
Privilege is a separate setting: a Privileged plan is visible only to people with Privileged access.
Also visible to shares a plan with other business units. They can view and link to it, but only the owning unit can edit it. On a plan shared into your unit, Make your own opens the New form pre-filled with a copy for your unit to propose.
Edits go through approval; deletion is immediate and permanent.
- 1
Propose an update
Click Propose Update on a row or on the plan's page, change the fields, and click Submit Update (propose).
- 2
Delete a plan
Owners and admins can click Delete on the plan's page, then Delete permanently. The plan and its links are removed.
- 3
Export
Export CSV on the register downloads the plans currently shown, with their linked records. For a formatted document, generate the Treatment Plans Register Report or Treatment Plan Report in Reports.