The risk register records what could go wrong, who owns it, how bad it is before and after your controls, and what you are doing about it. Every change is saved as a new revision, so the history stays readable.
Who can do this
An owner, editor or contributor of your workspace can add and revise risks. Only an owner or editor, on their own seat, can accept a risk. A viewer can read the register.
Find the register
Open Risk register in the sidebar, under Risk & audit. The figures at the top include Recorded risks, High or critical, Reviews due and Unassessed. You can search, and filter by department, residual score and lifecycle, and choose Include archived.
How risks are scored
Each risk is scored twice: inherent, before your controls, and residual, after them. A score is likelihood × impact, each from 1 to 5, so it runs from 1 to 25. The band, Low, Medium, High or Critical, follows from the score.
A risk with no score is unassessed. It is never read as low.
Add a risk
Press Add risk.
- Under About the risk, give the Risk title, a Category in your own company's risk vocabulary, and the Risk scenario and impact: what could happen, and what it would cost the company if it did.
- Choose the Owner and Department.
- Under Scoring, give the likelihood and impact for the inherent risk and for the residual risk. Give both of a pair, or leave both blank while that pair is unassessed.
- Under Treatment and review, choose the Treatment: Mitigate, Transfer, Avoid or Accept. Choose the Lifecycle, write the Treatment rationale, and set a Review date.
Press Create risk.
Accept a risk
Accepting a risk needs the authority to accept, a rationale and a future Acceptance expiry. Your name is recorded on the revision as the person who accepted it. No second approval is asked for.
Accepting does not close the risk. When the acceptance expires, the risk is due for review again.
Link controls and suppliers
When you add or edit a risk, use Linked controls and suppliers to link the controls that reduce it and the suppliers it depends on. Linking a record does not assess it.
Change a risk
Open the risk and press Edit risk. Make the change, say why under Reason for change, and press Save revision. The Revision history keeps each revision exactly as recorded, with who recorded it.
To take a risk off the current list, set its Lifecycle to Closed or Archived.
Common questions
"Does a lower score close the risk?" No. A score never changes the lifecycle. Change the lifecycle yourself.
"Why does a risk say reassignment needed?" Its owner is no longer available in your workspace. Edit the risk and name a new owner.