Score and treat a risk

Open the Risk Register and choose a risk. The full record shows its status, response, appetite status, project, artifact, and source context. Use the project or artifact links to inspect the original material when those links are available. Changes require Contributor, Admin, or Owner access to the risk's project.

Choose Edit to update the narrative and the other fields offered in the form, then Save. If you close with unsaved changes, keep editing or confirm Discard changes.

Assign owners and reviewersCopy Anchor Link

In Accountability, choose Add owner and select an eligible user or team. Add the people responsible for the risk and the team responsible for carrying out the work.

For review coverage, choose the role to assign, then Add reviewer and select an eligible member. The available roles are Approver, Reviewer, and Watcher. Where an existing reviewer's role is editable, change the role on their entry.

To remove an assignment, use the person's or team's remove control and confirm Remove. The confirmation for an owner explains that they lose owner access to the risk. If the picker has no eligible choices, check project membership and existing assignments with a project admin.

Assess exposure before and after controlsCopy Anchor Link

In Risk scoring, choose Edit scoring. Assess Exposure, Exploitability, Harm, and Scope both before controls and after controls. The level choices run from Very low to Very high; Not scored leaves a factor unset.

Inherent exposure describes the risk before controls. Residual exposure describes what remains after controls. Compare these with the control evidence and treatment work rather than lowering a score because an action is merely planned.

The editor previews inherent and residual exposure and the severity band. Use Severity override when you need to set the overall band explicitly; choose Use computed band to return to the calculated band. Choose Save scoring. The record also displays confidence and appetite status when available; confidence is read-only in this editor. Explain the treatment or acceptance reasoning in the narrative so another reviewer can understand why residual exposure differs.

If scoring cannot save, keep the editor open, read the error, and retry after correcting the issue. Reopen the record to check its saved values before repeating a change that may already have succeeded.

Build a treatment planCopy Anchor Link

1. In Treatment plan, choose Add action.
2. Enter the required Action title.
3. Choose an eligible Owner, a Due date, Action type, and Status as appropriate.
4. Use Detail to describe the work and Expected effect to explain how it should reduce likelihood or impact.
5. Choose Add action.

Edit an action as work progresses to keep its owner, date, status, detail, and expected effect current, then choose Save action. Use its delete control to remove an action that no longer belongs in the plan. Check the resulting list and success message before continuing.

Treatment actions and the risk's lifecycle are separate controls. After work finishes, reassess the residual score and use the risk's lifecycle actions to record the resulting status or review decision.

If no actions exist, start with the next concrete piece of work. If an action cannot be saved, check its title and any loading or error message in the owner picker, then retry. Add evidence and controls to support the treatment and score.