Creating and Managing Risks

Important:

The Export Risks and Business Objectives to PDF feature is under Public Preview. Please contact OneTrust Support to request early access.

The Risk register provides a centralized workspace for creating and managing risks, along with their related controls and objects. This helps your organization better evaluate control effectiveness and gain a clearer understanding of its risk landscape. While the Risk register is visible to all roles, the data visible will depend on the user’s access rights.

Within the Risk Register, you can track risks over time, manage associated tasks and control implementations, and view or edit risk attributes. Currently, there are two ways to create a risk record from the Risk Register screen:

  • Create a Custom Risk Build a new, standalone risk record tailored to your specific needs.

  • Create from Risk Library Generate a risk record based on a predefined template from the Risk Library, streamlining consistency and reuse.

To create custom risks

Creating Custom Risks: Standard Workflow

  1. On the IT & Security Risk Management menu, select Risk Register. The Risk Register screen appears.

  2. Click the Add risk button. The Create new risk screen appears.

  3. Select Create New Risk and complete the fields. For more information, see Create New Risk Screen Reference .

  4. Click the Next button. The Add controls screen appears.

  5. Click the Add controls button to the Add controls modal and add controls to the risk by selecting existing controls from the Controls Library or by creating a custom library control.





  6. Click the Save button. Or click the Save and Add New button to add the control and immediately add another control to this record.

  7. Click the Next button. The Add related objects screen appears.

  8. Click the Add related objects button. The Add related objects modal appears for you to select the object type and record you would like to link to this risk.



  9. Click the Add related button. Or click the Save and add new button to add the related object and immediately add another object to this record.

  10. Click the Create button. The Risk details screen appears. You can edit, track, and manage risks you have created from this screen.

Create New Risk Screen Reference



Important:

The risk score and risk level attributes listed on this screen appear based on the score type configured for attributes in the Attribute Manager. This includes custom score type attributes. Use the following list to determine when certain fields display.

Standard Score Type

- When this score type is selected, the risk score, risk impact level, and risk probability level fields will appear for the given attribute.

Formula Score Type

- When this score type is selected, the risk score field will not appear for the given attribute.

Matrix Score Type

- When this score type is selected, only the risk score field is displayed for the given attribute.

Field
Description
Organization Required

Select the organization responsible for the risk.

Inherent Risk Score

Select the inherent risk score. This is the overall risk score without considering existing controls.

Note:

This field will not appear if the Inherent Risk Score attribute is configured using the formula score type.

Alternatively, this field will be the only one to appear if the Inherent Risk Score attribute is configured using the matrix score type.

Inherent Risk Impact Level

Select the inherent risk impact level. This is the impact a risk would have on an organization if it occurred without controls to mitigate.

Inherent Risk Probability Level

Select the inherent risk probability level. This is the probability of the risk occurring if there were no controls in place.

Target Risk Score

Select the target risk score. This is the desired risk score.

Note:

This field will not appear if the Target Risk Score attribute is configured using the formula score type.

Alternatively, this field will be the only one to appear if the Target Risk Score attribute is configured using the matrix score type.

Target Risk Impact Level

Select the target risk impact level. This is the desired impact the risk would have on an organization if it occurred.

Target Risk Probability Level

Select the target risk probability level. This is the desired probability of the risk occurring.

Residual Risk Score

Select the residual risk score. This is the overall risk score after considering existing controls.

Note:

This field will not appear if the Residual Risk Score attribute is configured using the formula score type.

Alternatively, this field will be the only one to appear if the Residual Risk Score attribute is configured using the matrix score type.

Residual Risk Impact Level

Select the residual risk impact level. This is the impact a risk would have on an organization if it occurred with the current control implementations.

Residual Risk Probability Level

Select the residual risk probability level. This is the probability of the risk occurring with the current controls that are implemented.

Risk Name Required

Enter a name for the risk.

Threat

Select the threat(s) the risk poses to your company. A threat is an incident that has the potential to cause harm or expose vulnerabilities.

Vulnerability

Enter the vulnerability of the company to the risk. A vulnerability is a known weakness that would allow attacks if not contained.

Category

Select the associated category the risk falls under.

Risk Owners

Select the name(s) of the individual(s) responsible for remedying the risk. This user will be responsible for identifying, assessing, and managing risks. Risk Owners collaborate with Risk Managers and Control Owners to implement effective controls and conduct regular assessments.

Risk Approver

Select the name(s) of the individual(s) responsible for approving the risk. This user will serve as the final authority in the risk management process, reviewing and approving assessments to ensure risks are properly evaluated and addressed. Risk Approvers work with Risk Managers and Control Owners to align mitigation strategies with organizational goals.

Risk Manager

Select the name(s) of the individual(s) responsible for managing the risk throughout its lifecycle which includes creating and managing risk templates, assessments, attributes, and workflows. This user will oversee risks throughout their journey, ensuring they’re tracked, assessed, and addressed.

Deadline

Select the date by when the risk must be resolved.

Reminder

Enter the number of days before a deadline that a reminder is sent.

Description

Enter a description of the risk.

Treatment plan

Enter a plan to control, mitigate, and/or resolve the risk. The plan may include completing specific tasks, assigning a Risk Owner, and adding controls to mitigate the risk.

Treatment

Enter the treatment. This is the process by which the Risk Owner actively mitigates the risk.

Risk appetite

Select the level of risk an organization is willing to accept in pursuit of its objectives. It reflects the organization's strategic posture toward uncertainty and potential loss.

Risk tolerance

Select the acceptable level of variation in performance or outcomes relative to objectives. It’s more operational and specific than risk appetite.

Show More Details

Use this section to configure any custom attributes that have been created so that they can be populated. Any required custom attributes will appear above the Show More Details section.

Creating Custom Risks: Enhanced Workflow

  1. On the IT & Security Risk Management menu, select Risk Register. The Risk Register screen appears.



  2. Click the Add Risk button. The Add risk details screen appears.

  3. Select Create New Risk. Select Create New Risk and complete the fields. For more information, see Create New Risk Screen Reference .

  4. Click the Next button. The Add related objects screen appears.

  5. Click the Add related objects button to add objects impacted by the risk that will need mitigating controls. The Add Related Objects modal appears.

    Field
    Description
    Select object type

    Select the object that may be impacted by this new risk record.

    Select object record

    Select the specific object record based on the object type selected.

  6. Select the object type and object record.

  7. Click the Add object button. Or click the Save and add new button to add the related object and immediately add another object to this record.
    Note:

    You can remove objects previously added by clicking the Context Menu icon and selecting Remove.



  8. Click the Next button. The Select library controls screen appears.

  9. Add controls that will help mitigate the risk.

    Option 1: Select existing controls from the Controls Library. You can search for specific standards / frameworks or controls using the search bar.

    Option 2: Click the Create library control button to create a custom library control and click the Save button. Or click the Save and Add New button to add the control and immediately add another control to this record.





  10. Click the Next button. The Manage control implementations screen appears. The controls selected are aligned to related inventories selected in the earlier step.

  11. Review the control implementations related to the risk and decide whether the implementation will apply to one or many inventories.

    Note:

    The library controls without related inventories will be directly associated to the risk.

  12. Click a link in the Related inventories column to open the Manage control implementations modal.

    Tip:

    You can use the checkboxes to select the inventories you'd like to update in bulk. This allows you to update multiple records at once instead of updating them individually.

  13. Select how this implementation will be put into place.

    Option 1: Create a separate implementation for each control to share the implementation across multiple inventories. In this case, you must select the primary inventory to manage the implementation.

    Option 2: Create a shared control by creating one control implementation for each inventory selected.

  14. Click the Update Inventories button.

  15. Repeat steps 12 - 15 for each library control implementation.

  16. Click the Create risk button once you have finished managing the control implementations associated with the risk. The Risk Details screen appears.

    Note:

    For more information on editing and managing the risks you've created, see Managing Risks from the Risk Details Screen.

To create risks from the Risk Library

Create Risks from Library: Standard Workflow

  1. On the IT & Security Risk Management menu, select Risk Register. The Risk Register screen appears.

  2. Click the Add risk button. The Create new risk screen appears.

  3. Choose Select a risk from the library to auto populate the risk details and complete the fields as needed.

  4. Click the Next button. The Add controls screen appears.

  5. Click the Add controls button to the Add controls modal and add controls to the risk by selecting existing controls from the Controls Library or by creating a custom library control.





  6. Click the Save button. Or click the Save and Add New button to add the control and immediately add another control to this record.

  7. Click the Next button. The Add related objects screen appears.

  8. Click the Add related objects button. The Add related objects modal appears for you to select the object type and record you would like to link to this risk.



  9. Click the Add related button. Or click the Save and add new button to add the related object and immediately add another object to this record.

  10. Click the Create button. The Risk details screen appears. You can edit, track, and manage risks you have created from this screen.

Create Risks from Library: Enhanced Workflow

  1. On the IT & Security Risk Management menu, select Risk Register. The Risk Register screen appears.



  2. Click the Add Risk button. The Add risk details screen appears.

  3. Choose Select a risk from the library to auto populate the risk details and complete the fields as needed.

  4. Click the Next button. The Add related objects screen appears.

  5. Click the Add related objects button to add objects impacted by the risk that will need mitigating controls. The Add Related Objects modal appears.

    Field
    Description
    Select object type

    Select the object that may be impacted by this new risk record.

    Select object record

    Select the specific object record based on the object type selected.

  6. Select the object type and object record.

  7. Click the Add object button. Or click the Save and add new button to add the related object and immediately add another object to this record.
    Note:

    You can remove objects previously added by clicking the Context Menu icon and selecting Remove.



  8. Click the Next button. The Select library controls screen appears.

  9. Add controls that will help mitigate the risk.

    Option 1: Select existing controls from the Controls Library. You can search for specific standards / frameworks or controls using the search bar.

    Option 2: Click the Create library control button to create a custom library control and click the Save button. Or click the Save and Add New button to add the control and immediately add another control to this record.





  10. Click the Next button. The Manage control implementations screen appears. The controls selected are aligned to related inventories selected in the earlier step.

  11. Review the control implementations related to the risk and decide whether the implementation will apply to one or many inventories.

    Note:

    The library controls without related inventories will be directly associated to the risk.

  12. Click a link in the Related inventories column to open the Manage control implementations modal.

  13. Select how this implementation will be put into place.

    Option 1: Create a separate implementation for each control to share the implementation across multiple inventories. In this case, you must select the primary inventory to manage the implementation.

    Option 2: Create a shared control by creating one control implementation for each inventory selected.

  14. Click the Update Inventories button.

  15. Repeat steps 12 - 15 for each library control implementation.

  16. Click the Create risk button once you have finished managing the control implementations associated with the risk. The Risk Details screen appears.

    Note:

    For more information on editing and managing the risks you've created, see Managing Risks from the Risk Details Screen.

To delete risks

Important:

Only users with the Risk V2 Admin permission will be able to see deleted risks.

You can delete risks. This action is not permanent. Risks can be restored using the risk recycle bin.

  1. On the IT & Security Risk Management menu, select Risk Register.

    The Risk Register screen appears.

  2. On the Risk Register screen, click the checkbox for the risk(s) you would like to delete.


  3. Click the Delete Risk(s) icon.
    The Delete Risks modal appears.

  4. Click the Delete button. The selected risk(s) are moved to the recycle bin.

To restore risks

Important:

Only users with the Risk V2 Admin permission will be able to restore deleted risks.

You can use the recycle bin feature to restore deleted risks.

  1. On the IT & Security Risk Management menu, select Risk Register.

    The Risk Register screen appears.

  2. Click the Context Menu icon.
  3. On the Context menu, select View Deleted Records.
    The Recycle Bin screen appears.

  4. Click the checkbox for the risk(s) you would like to restore.
  5. Click the Restore Risks icon.
    The Restore Risks modal appears.

  6. Click the Restore button.

To permanently delete risks

Important:

Only users with the Risk V2 Admin permission will be able to restore deleted risks.

  1. On the IT & Security Risk Management menu, select Risk Register.

    The Risk Register screen appears.

  2. Click the Context Menu icon.
  3. On the Context menu, select View Deleted Records.

    The Recycle Bin screen appears.

  4. Click the checkbox for the risk(s) you would like to permanently delete.


  5. Click the Delete Risk(s) icon.

    The Delete Risks modal appears.

  6. Click the Delete button. The selected risk(s) are permanently deleted and cannot be restored.

To export risks

Exporting as XLSX file

  1. On the IT & Security Risk Management menu, select Risk Management > Risk register. The Risk register screen appears.

  2. On the Risk register list screen, click the Export icon.

  3. On the Export data modal, click the Export data button. The report will be generated in the background. When the report is ready to download, a notification will appear on the Notifications icon.

  4. Click the Notifications icon. The Notifications popover appears.

  5. Click the link corresponding to the report you exported. The file will download to your local system.

Exporting as PDF file

  1. On the IT & Security Risk Management menu, select Risk Management > Risk register. The Risk register screen appears.

  2. Click the check box next to the risk(s) you would like to export as a PDF file.

  3. Click the Export as PDF button in the screen header. The Export modal appears.

  4. On the Export modal, customize the naming convention of the exported file.

  5. Click the Export button. The Report download modal appears.

  6. Click the Close button. The report will be generated in the background. When the report is ready to download, a notification will appear on the Notifications icon.

  7. Click the Notifications icon. The Notifications popover appears.

  8. Click the link corresponding to the report you exported. The file will download to your local system.

Troubleshooting Tips

Use this section to troubleshoot common issues when viewing, creating, and managing risk records. The tips below help you identify likely causes, verify required settings, and resolve issues more efficiently so you can continue your work with minimal disruption.

Issue: User is unable to retrieve assigned risks

Symptoms

If a user is assigned to a risk record but cannot access it, they may see a 404 error with the message, “You are not authorized to access this resource.” This can occur even when the user, the assessment, and the risk record all belong to the same organization.

Possible Causes

This issue can occur when the risk record has not yet reached the correct workflow stage for the assigned risk owner to access it.

For accounts using the legacy risk workflow, the assigned risk owner can access the risk only when the record is in the Treatment - In progress stage. If the risk is still in the Identified stage and has not been moved to Treatment, the assigned user may not be able to open it.

Step-by-step Troubleshooting

  1. Review the risk workflow and the current stage of the risk record. If the risk uses the default risk workflow, confirm which stage the risk is currently in:

    • If the risk is in the Identified stage, users with the Project Respondent role or a similar lower-access role may not be able to open the risk record or view its details.

    • If the Treatment status is Under Review, the risk record may not be accessible unless the user has an elevated role, such as Site Admin.

  2. Review the setting in Risk settings that controls access across workflow stages. When this setting is enabled, users can access risk records in all stages.