Risk management
Choose treatment and link controls
Record the treatment decision, connect supporting controls, and track follow-up work.
Before you start
Who this is for: Risk owners and authorized risk managers; approval requires the relevant reviewer permission.
- Review the risk's scenario, assessment, and accountable owner.
- Agree on the intended response and identify existing controls or tasks.
Follow these steps
Describe the treatment
Open the risk's Treatment section. Choose the appropriate Treatment strategy from Accept, Avoid, Mitigate, or Transfer. Complete Treatment rationale and Treatment plan with the actual decision and work required. Selecting a strategy records a choice; it does not by itself complete formal approval.
Record assessed values
Add residual and target inputs only when you have a basis for them, and explain their rationale. Save the treatment section and recheck the displayed values. Keep planned improvement distinct from a result already supported by implementation evidence.
Link the implementation
Open Links to connect relevant controls and other records you can access. Inspect each existing record before linking it. Use Tasks for specific remediation work and Documents for supporting evidence where those actions are available. A relationship helps trace responsibility but is not proof of control effectiveness.
Arrange review
Use Review to record review cadence, next review, and an approval rationale where authorized. Complete the available treatment approval or risk-acceptance workflow through an eligible reviewer. Risk ownership does not authorize accepting your own risk; follow the enforced independence rules.
What you should see
The risk has a documented treatment plan, relevant relationships, and an identifiable review or approval state.
If something doesn’t look right
A control cannot be found
Confirm it belongs to this organization and is visible to your role. Search the existing control register before creating anything new.
Approval is unavailable
Check your permission and independence from the risk owner, plus the current workflow state.
A task is finished but the risk is unchanged
Review treatment evidence and update the assessment through the risk workflow. Task completion alone does not establish reassessed risk.
Still need a little help?
Ask the assistant about these steps, or tell our team where you got stuck.
Contact support