Managing Risk Details

You have the ability to fully manage risk records using the Risk Details screen. The ability to edit risks directly on the Risk Details screen offers several operational and strategic advantages. It allows for real-time updates, ensuring that risk information remains current and accurate as new developments arise. This immediacy reduces delays in communication and supports faster, more informed decision-making.

Adding related records, details, and attachments further improves the risk management process. It provides a comprehensive view of the risk by linking it to relevant incidents, controls, audits, or assets, helping stakeholders understand the full context. This holistic approach improves decision-making by consolidating relevant information in one, organized location.

Accessing the Risk Details Screen

There are multiple ways to access the Risk Details screen, which allows you to edit the risk and add related records. You can navigate to it either from the Risk Register or directly from an inventory record. This step is flexible, depending on where you're working within the system.

Navigate to Risk Details via the Risk Register

  1. On the IT & Security Risk Management menu, select Risk Register. The Risk Register screen appears.

  2. Click the ID Number of the risk you want to access. The Risk Details screen appears on the Details tab. 



Navigate to Risk Details via Inventory

  1. On the IT & Security Risk Management menu, select Inventory > Inventory Object. The corresponding inventory list screen appears. You can select from one of the following inventory objects: assets, processing activities, entities, or vendors. 

  2. Click the Name of the inventory you want to access. The Inventory Details screen appears.

  3. Select the Risks tab. 

  4. Click the ID Number of the risk you want to access. The Risk Details screen appears on the Details tab. 

Adding and Editing Risk Details

You can edit risk details, add related objects, link existing records, and review activity history to keep each risk accurate, connected, and easier to manage over time. These actions help provide a more complete view of the risk and support better decision-making.

To edit risk information

Important:

To edit custom attributes on the Risk details screen, Risk Owners must have one of the following:

  • The Edit risk custom attributes and Act as an admin on risks permissions; or

  • The Edit risk custom attributes permission and needs to be the Risk Approver

To edit the Treatment plan field, Risk Owners must have one of the following:

  • The Act as an admin on risks and Edit risks permissions; or

  • Be assigned as the Risk Approver

  1. Navigate to the Risk Details screen.
  2. Select the Details tab. 
  3. Hover over the field you would like to edit. The Edit Icon will appear to the right of editable fields. 
  4. Click the Edit Icon.
  5. Edit the fields as necessary.
  6. Click the Save button.

To add related risks

To add controls to risks

  1. Navigate to the Risk Details screen.
  2. Select the Controls tab.
    All controls related to the risk record will appear.

  3. Click the Add Control button to add controls that will help mitigate the risk. 

    Option 1: Select existing controls from the Controls Library. You can search for specific standards / frameworks or controls using the search bar. Controls that have already been related to the risk library will be selected for you. 

    Option 2: Click the Create library control button to create a custom library control and click the Save button. Or click the Save and Add New button to add the control and immediately add another control to this record. 

  4. Click the Next button.
    The Manage control implementations screen appears.

  5. Review the control implementations related to the risk and decide whether the implementation will apply to one or many inventories.
  6. Click a link in the Related inventories column to open the Manage control implementations modal.

  7. Select how this implementation will be put into place.

    Option 1: Create a separate implementation for each control to share the implementation across multiple inventories. In this case, you must select the primary inventory to manage the implementation.

    Option 2: Create a shared control by creating one control implementation for each inventory selected.

  8. Click the Update Inventories button.
  9. Repeat steps 5 - 8 for each library control implementation.
  10. Click the Add controls button once you have finished managing the control implementations associated with the risk.
    Note:

    For more information on editing and managing the risks you've created, see Managing Risks from the Risk Details Screen.

    The Risk Details screen appears.

To add tasks to risks

Important:

The View risk tasks and Create risk tasks permissions alone does not grant access to the task list on risk records. To view the task list, the user must be one of the following:

  • Risk owner

  • Risk approver

  • Risk manager

  • A user with at least one task assigned on that risk

  1. Navigate to the Risk Details screen.
  2. Select the Tasks tab.
  3. Click the Add Task button. The Add Task modal will appear.


    Field
    Description
    Task name

    Enter a name for the task.

    Description

    Enter a brief description of the task.

    Assignee

    Select the user responsible for completing the task.

    Priority

    Choose the priority level of the task.

    Task collaborators

    Select the user responsible for helping the task assignee complete the task.

    Deadline

    Select the date by which the task must be completed.

  4. Complete the fields.
  5. Click the Save button.

To add comments to risks

  1. Navigate to the Risk Details screen.
  2. Select the Comments tab.
  3. Type a comment in the comment box using the text editor as needed. You can mention users directly within comments using the icon to trigger both an in-app notification and email notification.


  4. Click the Add button to apply the comment to the risk record. 
    Note:

    Risk assignees, approvers, owners, and all users who have previously commented on the risk record will receive an email notification when a new comment is added to the risk.

To add attachments to risks

  1. Navigate to the Risk Details screen.
  2. Select the Attachments tab.
  3. Click the Upload Attachment button. The Attachments modal will appear.


  4. Click the Select File button and choose file you want to upload.
  5. Enter a description of the attachment.
  6. Click the Save button.

To add links to risks

  1. Navigate to the Risk Details screen.
  2. Select the Attachments tab.
  3. Click the Add Links button.
    The Add Links modal appears.

    Field
    Description
    URL

    Enter the URL to the hosted document.

    Name

    Enter the name of the external link.

    Description

    Enter a description of the document being linked.

  4. Complete the fields.
  5. Click the Save button to save the link or the Save and Add New button to save the link and immediately add another.

To view risk activity history

  1. Navigate to the Risk Details screen.
  2. Select the Activity tab. The Activity History will be displayed.


To add related objects to risks

You can add related objects to a risk to enhance risk management, traceability, and decision-making. Related objects help clarify the scope and impact of a risk. When adding certain objects to the risk (asset, vendor, processing activity, or entity) you can  link the object to existing controls mitigating the risk or to create new controls for the object to supplement the mitigating controls. This helps ensure that mitigation efforts are efficient and effective. For more information, see Managing Control Implementations.

  1. Navigate to the Risk Details screen.
  2. Select the Related tab. 
  3. Click the Add Related Objects button.

    The Add Related Objects modal appears.

  4. Select the object type and record that may be impacted by this risk. 
  5. Click the Next button.
    The Add inventory to controls modal appears.

  6. You can select from existing control implementations related to this risk or create a new implementation to add the related objects to a control. 
  7. Click the Add inventory button. 

Managing the Risk Workflow

You can update the workflow configuration to support your organization’s process and advance risks from one stage to the next as needed. Risk workflows help track risks and controls through defined stages and automate key parts of the risk management process.

To advance the risk workflow stage

Note:

Risk owners with a custom role must have the Change risk workflow stage permission to advance a risk workflow. This permission allows the user to move a risk through all workflow stages unless a stage is configured as an approval stage. For an approval stage, only the designated users can move the risk to the next stage.

  1. Navigate to the Risk Details screen.
  2. Click the Advance button. The Advance modal will appear.

  3. Click the Submit button to move the risk to the next workflow stage. For more information on advancing risks for approval workflows, see Using the Risk Workflow and Approval Tab.

To change the current risk workflow

Important:

When you change a risk workflow, the Result attribute is cleared before the new stage is assigned. This helps prevent outdated data from being carried forward when it may no longer be valid for the new workflow.

In custom workflows, the Result field can be edited from the Details tab until the risk is closed. In the Default Risk Workflow, the Result field remains locked, and invited users cannot edit it.

Since the Result field is a required attribute in the Monitoring stage of the Default Risk Workflow, you cannot move directly to that stage immediately after changing workflows. Instead, move the risk to a different stage first, then update the Result field before progressing the risk to the last stage.

  1. Navigate to the Risk Details screen.
  2. Click the Context Menu icon next to the current workflow.

  3. On the Context menu, select Change workflow.
    The Change workflow modal appears.

    Field
    Description
    Workflow

    Select the name of the workflow that you would like the risk to be assigned.

    Stage

    Select the workflow stage within the workflow selected that you would like the risk to be assigned.

  4. Choose the new risk workflow and stage. These fields are populated based on your current published workflows.
  5. Click the Save button.