Using the Risk Library

The Risk Library enables you to create and manage reusable risk templates, streamlining the process of documenting similar risks across the OneTrust Platform. This feature allows you to standardize the impact, likelihood, and scoring methods of a risk to reduce manual efforts and ensure consistency in risk assessments. You can also use the Risk Library to add and manage controls directly within templates, making it easier to align mitigation strategies with identified risks. This centralized approach helps to:

  • Improve efficiency

  • Enhance risk visibility

  • Support stronger compliance and decision-making

To create a new risk template

You can add risk templates to the Risk Library to standardize how risks are defined and assessed across your organization to save time and maintain consistency across similar risks.

  1. On the IT & Security Risk Management menu, select Libraries > Risk library.

    The Risk library screen appears.

  2. Click the Add risk button.

    The Add risk modal appears.

  3. Complete the fields. For more information, see Add Risk Modal Reference.
    Important:

    The Organization field will be auto-populated based on the user organization. Templates created on an organization will be accessible to users who are in the same organization, a parent, or a child organization. Users in a sibling organization will not have access to the risk template.

  4. Option 1: Click the Add button to add the template to the Risk Library without adding controls. The Risk library screen appears.

    Option 2: Click the Save and add controls button to add the template to the Risk Library and add related controls. The Add controls modal appears.

  5. On the Add controls modal, choose to add an existing control or create a custom control. For more information, see Managing Controls.
    Note:

    This modal only appears if you choose to add related controls during the template creation. You can also add and edit controls any time after the risk template is created.

  6. Click the Save button.

Add Risk Modal Reference

The risk score and risk level attributes listed appear based on the score type configured in the Attribute Manager. Fields will display based on the details below:

Standard Score Type

When this score type is selected, the risk score, risk impact level, and risk probability level fields will appear for the given attribute.

Formula Score Type

When this score type is selected, the risk score field will not appear for the given attribute.

Matrix Score Type

When this score type is selected, only the risk score field is displayed for the given attribute.



Field
Description
Risk Template

Enter a name for the risk template.

Risk Name

Enter a name for the risk.

Description

Enter a brief description of the risk.

Inherent Risk Score

Select the inherent risk score. This is the overall risk score without considering existing controls.

Note:

This field will not appear if the Inherent Risk Score attribute is configured using the formula score type. Alternatively, this field will be the only one to appear if the Inherent Risk Score attribute is configured using the matrix score type.

Inherent Risk Impact Level

Select the inherent risk impact level. This is the impact a risk would have on an organization if it occurred without controls to mitigate.

Inherent Risk Probability Level

Select the inherent risk probability level. This is the probability of the risk occurring if there were no controls in place.

Target Risk Score

Select the target risk score. This is the desired risk score.

Note:

This field will not appear if the Target Risk Score attribute is configured using the formula score type. Alternatively, this field will be the only one to appear if the Target Risk Score attribute is configured using the matrix score type.

Target Risk Impact Level

Select the target risk impact level. This is the desired impact the risk would have on an organization if it occurred.

Target Risk Probability Level

Select the target risk probability level. This is the desired probability of the risk occurring.

Residual Risk Score

Select the residual risk score. This is the overall risk score after considering existing controls.

Note:

This field will not appear if the Residual Risk Score attribute is configured using the formula score type. Alternatively, this field will be the only one to appear if the Residual Risk Score attribute is configured using the matrix score type.

Residual Risk Impact Level

Select the residual risk impact level. This is the impact a risk would have on an organization if it occurred with the current control implementations.

Residual Risk Probability Level

Select the residual risk probability level. This is the probability of the risk occurring with the current controls that are implemented.

Category

Select the associated category the risk falls under.

Threat

Select the threat(s) the risk poses to your company. A threat is an incident that has the potential to cause harm or expose vulnerabilities.

Vulnerability

Enter the vulnerability of the company to the risk. A vulnerability is a known weakness that would allow attacks if not contained.

Treatment Plan

Enter a plan to control, mitigate, and/or resolve the risk. The plan may include completing specific tasks, assigning a Risk Owner, and adding controls to mitigate the risk.

Show More Details

Configure any custom attributes that have been created so that they can be populated. The required custom attributes will appear above the Show More Details section.

To dedupe risks using the risk library

Dedupe Scenario 1: Flagging Risks on Assessments

When adding risks to an assessment using a risk template, the template can only be used once to create a new risk. All other risks created on the assessment using the same risk template will be linked to the existing risk. These risks are created using pre-configured automation rules.

Examples

  • Flag a risk on a submitted assessment using a Risk Template, then copy or reassess it with the Link risks from original assessment setting enabled. When the reassessed version is submitted and the same Risk Template is used to flag a risk, a confirmation modal will appear.

  • Flag a risk on question #1 of a submitted assessment using a Risk Template.

    • If you try to flag a risk on question #1 using the same Risk Template, you will get a warning message.

    • If you try to flag a risk on question #2 using the same Risk Template, you will get a confirmation modal.

Dedupe Scenario 2: Assessments with Inventory Type Question

When adding risks to an assessment with an inventory type question using a risk template, the dedupe feature will ensure that the risks are not duplicated at the inventory level. These risks are created using pre-configured automation rules.

Note:

You can use the same risk template multiple times on an assessment if the risk is being flagged on multiple inventory questions. For example, if there are two inventory questions you can use the same risk template for all questions associated with inventory one and two.

Example

  • For this example, a template has been created with two inventory type questions. Both of the associated attribute / template questions include template rules that flag risks using the same Risk Template for all valid assessment responses. The following is expected:

    • The risk icon is displayed against each question. These will be shared risks that use the same Risk ID. At the assessment level, the flag icon will only indicate one risk. I.e. the same Risk Template with multiple risks will not be flagged with the same primary record.

    • Risks will be displayed with the new Risk ID when the primary record is different.

    • When manually adding risks with the same Risk Template to the same primary record, a warning message will appear.

Dedupe Scenario 3: Copied/ Reassessed Assessments

When adding risks to a copied or reassessed assessment using a risk template, all the risks will be deduped on the new assessment. This feature ensures duplicate risks are not created when you are reassessing on a yearly basis.

Note:

When an assessment is copied or reassessed, the associated risks will be related to the record only when the Link risks from original assessment setting is enabled.

Dedupe Scenario 4: Inventory Levels

When an inventory has more than one assessment using the same risk template, only one risk will be created. An inventory can only have one risk created using the same risk template.

To archive risk templates

  1. On the IT & Security Risk Management menu, select Libraries > Risk library.

    The Risk library screen appears.

  2. Hover over the row of the risk template you would like to archive until the Context Menu icon appears.
  3. Click the Context Menu icon and select Change Status. =
    The Change risk status modal appears.

  4. Choose Archived as the new status.
  5. Click the Change button.
    The updated status will appear on the Risk Library screen.

To export risk templates

  1. On the IT & Security Risk Management menu, select Libraries > Risk library.

    The Risk library screen appears.

  2. Click the Export button.
    The Report download modal appears.

  3. Click Close button. The export will be generated in the background. When the report is ready to download, a notification will appear on the Notifications icon.
  4. Click the Notifications icon.
    The Notifications popover appears.

  5. Click the export link in the popover to download the exported list.

To delete risk templates

  1. On the IT & Security Risk Management menu, select Libraries > Risk library.

    The Risk library screen appears.

  2. Hover over the row for the record you'd like to delete and click the Context Menu icon.
  3. On the Context menu, select Delete.
    The Delete Risk modal appears.

  4. Select the checkbox next to I understand this action is irreversible.
  5. Click the Delete library risk button to permanently delete the risk library record.

Leveraging risk templates

Risk templates can be applied across multiple areas of the platform, including assessment questions, templates, and inventory records to streamline risk identification and management. By linking predefined risks, organizations can ensure consistent tracking, reduce manual entry, and improve visibility into recurring threats.

To use risk templates in assessments

  1. Open an assessment in the Under Review stage.
  2. Click the Flag risks icon on a question in which you'd like to add a risk.

    The Flag risk modal appears.

  3. Select a risk template in the Select a risk field to auto-populate details from the risk template.
    Note:

    You can enter additional details as needed, like the Risk Owner, Risk Approver, deadline, reminder, etc.

  4. Click the Add button to add the risk using the template. Click the Save and add controls button to create the risk and immediately add controls to the risk record.

To use risk templates in templates

  1. Open a template in the Draft status. You can create new templates from the gallery or create a custom template. For more information, see Creating a New Template.
  2. On the Template details screen, select the Rules tab.
  3. Click the Add rule button.
  4. Configure the rule conditions and select Create risk for the rule action. For more information, see Configuring IT Risk Management Template Rules.
  5. Select a risk template in the Select a risk field to auto-populate details from the risk template.
    Note:

    You can enter additional details as needed, like the Risk Owner, Risk Approver, deadline, reminder, etc.

  6. Click the Save button to add the template rule.

To use risk templates in inventories

  1. Open an inventory record.

    The Inventory Details screen appears.

  2. Select the Risks tab and click the Add risk button.
    Note:

    In some products, you may have to click the Context Menu icon on the top-header and select Flag risk instead of navigating to the Risks tab.

  3. Select a risk template in the Select a risk field to auto-populate details from the risk template.
    Note:

    You can enter additional details as needed, like the Risk Owner, Risk Approver, deadline, reminder, etc.

  4. Click the Add button to add the risk to the inventory record. Click the Save and add controls button to create the risk and immediately add controls to the risk record.

Managing risk template details

The Risk Library offers powerful tools for maintaining and refining your risk templates. In this section, you'll learn how to edit template details to keep risk definitions accurate and relevant, view activity history to track changes and maintain audit readiness, and add or remove controls to align mitigation strategies with evolving threats.

To edit risk templates

Editing a risk template after a risk has been created using the template will not impact existing risks. All risks created after the risk template is edited will be updated with the new details.

Note:

The Standards / Frameworks field now appears on risk details for library templates. It’s auto-populated based on imported risks, not just controls. If risks come from multiple frameworks, all are shown. The field updates immediately after import.

  1. On the IT & Security Risk Management menu, select Libraries > Risk library.

    The Risk library screen appears.

  2. Open the risk template you would like to edit.

    The Risk details screen appears.

  3. Click in a field to open all the template fields that can be edited.


  4. Edit the fields as needed.
  5. Click the Save button.

To add controls

Adding controls to a risk template after a risk has been created using the template will not impact existing risks. All risks created after the risk template is edited will be updated with the new controls.

Note:

To remove an existing control added to the risk template, hover over the row for the control you'd like to remove, click the Context Menu icon and select Remove.

  1. On the IT & Security Risk Management menu, select Libraries > Risk library.

    The Risk library screen appears.

  2. Open the risk template in which you'd like to add controls.

    The Risk details screen appears.

  3. Select the Controls tab.
  4. Click the Add control button.
    The Add controls modal appears.

  5. Choose to add an existing control or create a custom control. For more information, see Managing Controls
  6. Click the Save button.

To view implementations

  1. On the IT & Security Risk Management menu, select Libraries > Risk library.

    The Risk library screen appears.

  2. Open the risk template in which you'd like to view implementations.

    The Risk details screen appears.

  3. Select the Implementations tab to view all the locations where this risk template is being implemented or reused.


To view activity history

  1. On the IT & Security Risk Management menu, select Libraries > Risk library.

    The Risk library screen appears.

  2. Open the risk template in which you'd like to view the activity history.

    The Risk details screen appears.

  3. Select the Activity tab to view all activity related to the risk template.
    The activity history appears.

    Note:

    • Click the Sort icon to change the order of the activity log (ascending/descending).

    • Click the Expand All button to expand each item to show details about the changes made.

    • Click the Collapse All button to close the detail view for each item. This button appears in place of the Expand All button when all of the items are expanded.