Who: Risk Officer or authorised risk owner. Entry: Assurance > Risks.
- Create or open the risk and enter a clear cause, event and consequence in its description.
- Select the owner, category and applicable domain/sub-domain. Record likelihood and impact using your organisation's approved scale.
- Review the calculated inherent score. Enter the evidenced residual score and target likelihood/impact where used; these describe different points in the treatment process.
- Select a treatment approach and link the relevant controls, tasks and evidence through the available record sections.
- Use the supported Assess, Treat, Monitor or Accept actions as the work progresses. Record the rationale for acceptance and follow your organisation's delegation.
- Check the risk list and its exposure/appetite summary after saving. Maintain appetite thresholds through the risk-appetite maintenance link if authorised.
Reading the charts: Risk bands retain their standard grey, green, amber and red colours, now shown in softer shades, with the band name and score on each rating. Read those labels when comparing severity; the new colours do not change assessment thresholds. The donut legend gives the count in each band for the filtered list. In the exposure chart, the solid line is recorded exposure and the dashed line is the tolerance envelope; the figures below give their latest values. Operational warnings, such as exposure above tolerance, retain their warning labels and colours.
Complete when: The risk has an owner, understandable assessment, treatment decision and supporting evidence. Its lifecycle is Identified → Assessed → Treating → Monitoring → Closed, with supported acceptance and reopening paths. A score below a threshold is not automatic approval to accept the risk.