About

Risks is your risk register. It records what could go wrong, scores each risk by how bad it would be and how likely it is, tracks how you plan to treat it and who owns it, and links it to the controls, assets and vendors involved. That gives you one place to show a client, and their auditor, which risks you know about and what is being done about them.

The page has three tabs:

• Dashboard: charts and counts that summarize the register.
• List: every risk in a table, where you create and manage risks. This tab opens first.
• Snapshot: dated, read-only copies of the register.

Super Admins and Compliance Managers create and manage risks. The register is not tied to one framework. It shows every risk for the client, whichever framework is selected in the sidebar.

Open Risks

1. In the sidebar, under Manage, select Risks. It sits with Controls, Assets, People, Vendors and Trust.
2. Choose a tab: Dashboard, List or Snapshot.

Read the Dashboard

The Dashboard tab starts with a row of cards, followed by charts. The cards show:

• Overall risk: a single rating for the register, such as Medium.
• All risks: the total number of risks.
• Assessed, Not Assessed, Assessment in progress and Needs Remediation: how many risks are in each of those statuses.

Below the cards are these charts and tables:

• Risk Breakdown: the number of risks in each status: Assessed, Not Assessed, Assessment in progress, Needs Remediation, Remediated and Closed.
• Risk Heat Map: a grid of impact (Negligible to Catastrophic, down the side) against likelihood (Rare to Certain, along the bottom). Each cell shows how many risks fall there. Select a cell to open the List filtered to that impact and likelihood.
• Risk Rating Breakdown: the number of risks at each rating, such as Low, Medium, High and Severe.
• Action Plan Breakdown: the number of risks for each treatment: Avoid, Reduce, Transfer, Share and Accept.
• Top Company Risks: up to 15 of the highest-ranked risks, in a table with Risk, Owner, Status, Treatment, Score and Mappings. This table is for reading only.

Work in the List

The List tab shows a count such as "Showing 25 risks" and one row for each risk. The columns are:

• Risk: the name of the risk.
• Owner: the person responsible, shown as an avatar.
• Status: where the risk is in its life.
• Treatment: the response you have chosen, or "Not set".
• Score: a coloured rating with the number, for example "High (12)".
• Mappings: how many items the risk is linked to, such as "2 mappings". Select it to see the linked items by type.

The toolbar above the table has these tools:

• Search risks: the search box for the list.
• Filter: narrows the list by Owner, Status, Department, Category, Treatment or Framework, and by risk scores and mappings.
• Display: chooses which columns to show and in what order. Department and Category are available but hidden until you turn them on. The Score column is called "Current risk" in this menu.
• Export: exports the register. See "Export the register" below.
• Import: adds many risks at once. See "Import risks" below.
• Create Risk: adds one risk.

Change several risks at once

1. Tick the boxes at the left of the rows you want. Tick the box in the header to select every row.
2. When the bar of actions appears, choose one of them. If you want the whole filtered set, select the option that reads "All N risks matching the current filters are selected."

The bar offers these actions:

• Assign: set the owner.
• Tag: add tags.
• Update: change Department, Category, Status or Treatment.
• Set status: change the status.
• Set treatment: change the treatment.
• Delete: remove the selected risks.

Create a risk

You can create one risk with the quick form, or add many at once by importing.

Create one risk

1. Select Risks › List › Create Risk. A form opens above the table.
2. Type a name where it reads "Name the risk". You can add a short note on the business impact in the line below it.
3. Optionally, select Owner, Department, Category, Impact or Likelihood to set them now.
4. Select Save, or press ⌘ + Enter (Ctrl + Enter on Windows). To close the form without saving, select Cancel or press Esc.

A message reads "Risk created." and the risk appears in the list. The name is the only thing you must fill in. Scores, treatment, links and plans can be added later on the risk's own page.

Create a risk from anywhere

You can open the same form without leaving the page you are on:

1. Select the LaunchPad search box at the top of the page.
2. Type /r (or /risk) and press Enter.

Import risks

1. Select Risks › List › Import.
2. Choose how to import:

• Upload CSV: opens "Import risks from a delimited file". Choose your file and match its columns to the risk fields. The file is checked before anything is imported. Impact and likelihood values must be numbers from 1 to 5.
• Import from risk set: choose a ready-made set of risks to add. Each set shows how many risks it contains.

Open a risk

Select a risk's name in the list to open its page. The title shows the risk ID and name, for example "RSK-1" and "Phishing". Select either one to edit it. Use the back arrow to return to the list, and Prev and Next to move between risks.

The page has these parts:

• A score strip with three scores: Score, Target risk and Inherent risk.
• Seven tabs: Overview, Score history, Mappings, Advanced Loss Analysis, Comments, Activity and Watchers.

The Overview tab holds these fields:

• Status, Owner, Team, Department and Category.
• Treatment and Tags.
• Four text boxes you can write in: Risk summary, Business impact, Treatment plan and Residual treatment plan.

Under the text boxes, an Action Items section lists the action items linked to the risk. It reads "No action items" when there are none.

Watchers are people who follow changes to the risk without owning it.

Score a risk

Each risk has three scores, and each one is made from an impact and a likelihood:

• Inherent risk: how serious the risk is before any controls.
• Score: how serious it is today, with your current controls.
• Target risk: where you want it to be.

1. Open the risk.
2. In the score strip, select the score you want to change.
3. Choose the impact and the likelihood.

The score is the impact multiplied by the likelihood. For example, a likelihood of Unlikely and an impact of Marginal gives Low (4). The number sets the rating, such as Low, Medium, High or Severe, and its colour. The list shows the current Score for each risk. Open the Score history tab to see how a risk's score has changed over time.

Set the owner, status and treatment

You can set these on the risk's Overview tab, or straight from the list:

• Owner: the person responsible for the risk. Owners are users in your account. A risk can also stay unassigned.
• Status: Not assessed, Assessment in progress, Assessed, Needs remediation, Remediated or Closed. Status says where the risk is in its life.
• Treatment: Avoid, Reduce, Transfer, Share or Accept. Treatment is the response you have chosen.

To change them for several risks at once, select the rows in the list and use Assign, Set status or Set treatment.

Record how you will deal with the risk in the Treatment plan box on the Overview tab. Once controls are in place, use the Residual treatment plan box to describe what remains.

Link a risk to controls, vendors and more

1. Open the risk and select the Mappings tab.
2. Find the type you want to link: Mitigating controls, Objectives, Assets, Asset Types, Vulnerabilities or Vendors.
3. Search for the item and select it to link it. To remove a link, unmap the item.

The Mappings column in the list updates to show the new count. Risks linked to a vendor count in the Vendors dashboard.

Take and read a snapshot

A snapshot is a dated, read-only copy of the register. Use it to keep a record of where your risks stood at a point in time.

1. Select Risks › Snapshot › Take snapshot. A new row appears with today's date.
2. Select the date to open the snapshot.

The table lists each snapshot's date, how many risks it holds and who took it. An open snapshot is marked "Historical snapshot — read only. Deleted risks remain available for inspection." In it you can:

• Search risks in the snapshot, and filter them by Owner and Status.
• Page through the risks with Previous and Next.
• Select Export snapshot to download the snapshot as an Excel (.xlsx) file.
• Select Back to snapshot history to return to the table.

To delete snapshots, tick them in the table and select Delete. A message asks "Delete snapshot history?" before anything is removed.

Export the register

1. Select Risks › List › Export.
2. Select Start export.

The dialog tells you the export may take several minutes and that the file will be available in the Generated Reports section.

Delete a risk

Select the bin icon at the end of the risk's row. To delete several, tick the rows and select Delete.