Track risk treatment
Choose a strategy, track controls and review residual risk.
Access: member. Beta feature, subject to enabled modules and your plan.
Open the risk
Open the risk from Registers → Risks. Check its scenario, scope, owner and assessment before deciding treatment.
Organize treatment
- Choose an offered strategy: reduce, accept, transfer or avoid the risk.
- Record the decision and treatment deadline.
- Add the necessary controls. A control can link to a compliance requirement or be described specifically for the risk.
- Assign an owner and deadline where offered.
- Update control status as work progresses: planned, in progress, implemented, verified or not applicable.
- Reassess residual risk based on controls actually implemented.
Understand statuses
A risk can be draft, identified, assessed, treated, accepted, closed or needing review. Use available record actions to move through its lifecycle. A control marked implemented is not necessarily verified yet.
Expected outcome
An authorized person can find the decision, planned actions and information supporting the residual level. Status should reflect the actual situation.
Points to watch
Do not lower residual risk solely because an action is planned. Check implementation evidence. If an action is unavailable, check permissions and the current risk status.
See also The treatment journey and Exemptions.