Risk Playbooks

Use these playbooks when working inside the Risk Management module. They explain the risk lifecycle, reassessment triggers, audit impact, and closure rules in the context of the risk register.

Manage a Critical Risk to Acceptance or Closure

1. Open Risk Management.
2. Create or open the risk.
3. Confirm title, source, consequences, category, owner, asset, vendor, policy, and related controls.
4. Assess inherent likelihood and impact.
5. Plan treatment: mitigate, transfer, avoid, accept, or monitor.
6. Add linked controls and treatment actions.
7. Record target score if treatment is expected to reduce exposure.
8. Complete treatment actions and upload evidence.
9. Record residual likelihood and impact only after evidence supports the change.
10. Compare residual score against appetite.
11. Accept the risk if residual exposure remains above tolerance and business acceptance is justified.
12. Close only when the risk is resolved, no longer active, or formally accepted according to policy.

Reassess a Risk After a Control or Assessment Change

Use this when the risk is flagged Needs Reassessment.

1. Filter the register by Needs Reassessment.
2. Open the risk.
3. Review the reassessment reason.
4. Check the linked control, assessment, exception, issue, or audit finding.
5. Review whether control effectiveness changed.
6. Update residual likelihood and impact if exposure changed.
7. Update treatment actions if more work is needed.
8. Add evidence or comments explaining the decision.
9. Click Mark Reassessed when complete.

Close a Risk Linked to an Audit Finding

Do not close a risk simply because an audit finding was submitted for verification.

Correct sequence:

1. Confirm the finding is linked to the risk or issue.
2. Confirm remediation evidence exists.
3. Wait for auditor verification.
4. If the finding is linked to an assessment control, wait for targeted reassessment.
5. Review the reassessed control status and evidence.
6. Update residual score if the corrected control reduces exposure.
7. Close the risk only when residual exposure is resolved or formally accepted.

Screenshots

Risk Register

Dashboard Context

FAQ

Question	Answer
What is the risk score formula?	Likelihood x Impact. The scale may be 5x5, 4x4, or tenant-configured.
When should residual score be reduced?	Only after implemented controls or treatment evidence supports lower exposure.
Can I close an above-tolerance risk?	Usually no. It must be accepted first according to the active appetite policy.
What does Needs Reassessment mean?	Something changed in a linked control, assessment, exception, issue, or finding that may affect exposure.
Can audit verification close a risk automatically?	No. Verification informs the risk owner, but the risk still needs scoring and closure decision.