Create or Edit a Risk

create a risk to define and manage issues and potential problems to create or edit a risk, you must log in to as a grc manager to create a risk open the risk workspace click new risk to open a blank risk form enter the following information into the overview section as required field description title enter a title for the new record team from the dropdown, select the team for which the risk record is being created owner from the dropdown, select the owner name date identified click the calendar icon and select the date on which the risk was identified last review date click the calendar icon and select the date by which the risk is expected to be reviewed review cadence from the dropdown, select the frequency with which the risk needs to be reviewed create review tasks select the checkbox to create review tasks status from the dropdown, select the relevant status of risk record draft initial pre‑risk state the item is not yet confirmed as a risk new the risk is identified but not yet assessed a risk owner (operator) is not yet assigned under review a risk owner (operator) is assigned the risk is being analyzed for likelihood, impact, and response options assessed risk analysis is complete the risk is scored and categorized response planned a treatment strategy is planned (mitigate, accept, transfer, or avoid) when response is planned, risk response field should be selected treatment in progress mitigation actions are in progress the risk response field might indicate mitigate or avoid at this stage monitored the risk is under observation after treatment the treatment can be mitigate , accept , transfer , or avoid if mitigation is implemented through controls or a mitigation plan, you should select a mitigation strength value retired the risk is no longer relevant elevated the risk remains on the register and is submitted for emergency response risk response refers to the action or strategy chosen to address the identified risk from the dropdown, select the following appropriate option mitigate reduce the impact of the risk with controls or a mitigation plan accept accept the risk without additional action transfer transfer the case to an it incident avoid take steps to eliminate the risk or its impact entirely source from the dropdown, select the relevant source audit , manual , risk assessment , or vulnerability scan risk type from the dropdown, select the type of risk that might impact the project risk category from the dropdown, select the category of risk based on the risk type risk sub category from the dropdown, select the sub category of the risk category inherent impact from the dropdown, select the severity of impact that the risk has on the project inherent likelihood from the dropdown, select the likelihood that the risk may have an impact on the project inherent risk this field auto populates and it indicates the risk score based on inherent likelihood and inherent impact mitigation strength indicates the effectiveness of controls or a mitigation plan in reducing the impact of the risk select an appropriate option from the dropdown unknown select when mitigation measures are not identified none select when no mitigation measures / controls are currently in place weak (10% reduction) select when controls exist but are minimal or largely ineffective in reducing the risk moderate (50% reduction) select when controls are implemented but provide only partial risk reduction strong (70% reduction) select when controls are effectively implemented and significantly reduce the risk very strong (90% reduction) select when controls are highly effective and provide near‑maximum risk reduction residual impact indicates the level of impact a risk still has after all mitigation actions or controls are applied select an appropriate option from the dropdown residual likelihood indicates the probability of a risk event occurring after mitigation actions or controls are implemented select an appropriate option from the dropdown residual risk indicates the current risk score after controls and mitigations this field auto populates based on the scores of residual likelihood and residual impact grade change graphically represents the risk level displays icon to indicate increasing risk (if residual risk is greater than inherent risk) displays icon to indicate no change to risk (if residual risk is equal to inherent risk) displays icon to indicate decreasing risk (if residual risk is less than inherent risk) no icon, if the residual risk or inherent risk fields are blank mandatory fields are marked with an asterisk enter the following information into the details section as required field description description enter a detailed explanation of the identified risk you can include the nature of the risk, context, and potential impact triggers enter the events or conditions that can cause the risk to occur, such as system failures, human error, external attacks, or regulatory changes root cause analysis describe the fundamental reasons behind the risk’s existence, such as process gaps or lack of control threat category classify the risk according to the type of threat it poses select the appropriate category from the dropdown confidential select the checkbox to restrict access to the risk record if it contains sensitive or confidential information data privacy risk specify if the risk is related to data privacy select the following appropriate option from the dropdown confidentiality select when there is a risk of unauthorized data disclosure integrity select when there is a risk of unauthorized data alteration availability select when there is a risk of data or system unavailability attachments click attach to upload supporting documents related to the risk, such as assessments, evidence, or mitigation plans use the controls , mitigation plans , assets , risk assessments , audits , policies , tasks , changes , incidents , problems , and security incidents tabs to link supporting records to the risk use the controls and mitigation plans tabs to create new controls and mitigation plans you can restore hidden tabs using the plus sign (to the right of the tabs) click save click refresh if changes you made or relevant tabs are not shown in the record after you have saved it edit a risk to edit a risk double click the risk to open the details edit the information as required click save