Creating and editing risks

This article covers the risk record itself rather than its scores: creating it, classifying it, linking the assets it threatens and the controls that treat it, assigning an owner, and archiving it when it no longer applies. For scoring, see Conducting Risk Assessments.

Adding new risks

A risk needs only a name to exist; classification, links, and scores can all follow later.

Creating a risk

1. Go to the Risks page via the main menu
2. Click "Add risk" in the top right of the overview
3. The creation form opens where you can fill in risk information

Filling in risk information

Only the name is required; a custom ID and owner can be added now or later.

Required fields:

• Name - Choose a clear, descriptive name for the risk
• For example: "Malware installation on systems" or "Insufficient management involvement"

Optional fields:

• Custom ID - Your own reference number (e.g. "R.IT.01", "R.HR.03")
• Assign owner - Select the responsible person from the dropdown
• Description - Explain what this risk entails and why it's relevant

Saving the risk

1. Check all entered information
2. Click "Create" to create the risk
3. The new risk appears in your overview with initial status

Editing risk information

The detail panel holds the risk's own fields and its classification attributes.

Opening risk details

1. Click on a risk name in the overview
2. Select the "Details" tab in the risk interface
3. All editable fields are displayed

Adjusting basic information

Once created, a risk's name, validity period, appetite, and description can all still be changed.

Editable fields in Details tab:

• Name - Adjust risk name
• Custom ID - Change for better reference
• Valid from / Valid to - Set validity period
• Risk Appetite - Determine acceptable risk levels
• Description - Extended risk description

How to edit information:

1. Click in the relevant field
2. Adjust the text or date
3. Click the Update button on the left bottom or top right of the screen to save changes

Risk classification

Attributes let you tag a risk with the domain, category, or threat group it belongs to.

Adding attributes:

1. Scroll to "Attributes" section
2. Click "Add attribute"
3. Enter a title (e.g. "DOMAIN", "RISK CATEGORY")
4. Enter a value (e.g. "Equipment", "Information risk")
5. Attributes help with filtering and reporting

Examples of useful attributes:

• DOMAIN - IT, HR, Finance, Operations
• THREAT GROUP - Cyber, Physical, Personnel, External
• IMPACT TYPE - Financial, Reputation, Operational, Compliance

Linking assets to risks

Linking assets records what the risk actually threatens, which in turn suggests which controls belong on it.

Why link assets?

By linking business assets, you establish which systems, data or processes are threatened by this risk.

Selecting assets

1. Go to the "Assets" section in the Details tab of the risk
2. View available assets in the list
3. Select relevant assets by checking checkboxes
4. Links are automatically saved

Selection criteria:

• Direct exposure - Asset is directly threatened by this risk
• Critical dependency - Asset is essential for business operations
• Data sensitivity - Asset contains confidential information
• Compliance impact - Asset falls under regulations

Owners and responsibilities

A risk needs an owner before its assessment can move past Not assigned.

Assigning risk owners

The owner is the person ultimately accountable for how the risk is managed.

Setting Owners:

1. Find "Owners" section on the right side of Details tab
2. Click the user icon
3. Type username and select from dropdown
4. Multiple owners possible for shared responsibility

Assigning Executors:

• People who perform executive tasks for risk treatment
• Often operational staff or specialists
• (future feature) Automatically assigned to new manual tasks

Appointing Assessors:

• People who perform risk assessment tasks
• Usually risk managers or compliance officers
• Independent from implementation team
• (future feature) Automatically assigned to new risk assessment tasks

Managing risk lifecycle

A risk has to be activated before it counts, and archiving keeps its history when it stops applying. Deleting does not.

Risk activation

A risk becomes "Active" when:

• The "Valid from" date is in the past
• The "Valid to" date is in the future (or empty)
• Controls are linked to the risk

Active risks:

• (future feature) Will be included in scheduled risk assessments
• Visible in dashboards and reports

Risk archiving

Archive a risk once it's genuinely no longer relevant, rather than deleting it, so the history survives.

When to archive:

• Risk is no longer relevant
• Business activity causing the risk has stopped
• External circumstances make risk irrelevant
• Risk has been merged with another risk

Archiving process:

1. Select one or multiple risks with checkboxes in overview
2. Click "Archive" button at top of table
3. Confirm archiving - risks disappear from daily overview
4. Historical data remains available for audit

Effect of archiving:

• Risk appears in "Archived" tab
• All links remain preserved but hidden
• No new assessments or treatments
• Reports don't account for archived risks

Risk deletion

Delete a risk only when it should never have existed: a test entry, a duplicate, or data that must not be retained.

When to delete:

• Test risk with incorrect information
• Duplicate risk accidentally created
• Sensitive information that must not be retained
• Organisation requires permanent deletion

Deletion process:

1. Select risks with checkboxes
2. Click "Delete" button at top of table
3. Confirm permanent deletion - irreversible action
4. All linked data is completely erased

Planning risk treatment

Once treatment is decided, the linked controls are what carry it out, so their effectiveness is what you monitor from here on.

Linking treatment strategies

Treatment is set from the risk's own Assessment tab, and choosing Reduce is what requires you to link controls.

After risk assessment:

1. Go to the "Assessment" tab of the risk
2. Select or change treatment option (Reduce, Accept, Transfer, Avoid)
3. For "Reduce" - Link relevant controls
4. Add justification in comments field

Monitoring control effectiveness

Treatment isn't a one-time decision. Check periodically whether the linked controls still hold up against new threats.

Ongoing evaluation:

• Regularly check if linked controls are effective
• Update risk assessment when circumstances change
• Adjust treatment for new threats
• Changes are automatically documented in Feed tab

Bulk operations

Selecting several risks at once lets you apply the same owner, attribute, or archive action to all of them.

Managing multiple risks simultaneously

Bulk actions cover archiving and deleting, not owner or attribute changes.

Available bulk operations:

• Archive - Move multiple risks to archive
• Delete - Permanently delete selected risks

Bulk workflow:

1. Select risks with checkboxes on left in overview
2. Relevant buttons appear at top of table
3. Choose desired action and confirm

Not possible for bulk:

• Edit risk descriptions
• Manage attributes
• Adjust asset links
• Report on selected risks

Risk reporting

Export the risk register when you need it outside Tidal, for management reporting or an audit.

Using export functionality

The exported file is a snapshot at that moment, not a live sync.

Generating risk report:

1. Click "Export report" in top right of overview
2. Excel file is downloaded with:
   • Risk names and IDs
   • Inherent and residual risk scores
   • Treatment status and linked controls
   • Asset links
   • Control effectiveness per linked Risk

Reporting applications:

• Management presentations about risk profile
• Audit documentation for compliance
• Trend analysis over time
• Benchmark comparison with previous periods
• Monitor impact of ineffective controls on current residual risks

Best practices for risk management

A risk register stays usable when risks are identified from more than one source, named consistently, and reviewed on a fixed rhythm.

Risk identification

Risks surface fastest when more than one perspective looks for them, not just the person filling in the register.

Systematic approach:

• Use templates for standard risks
• Involve different perspectives (IT, HR, Operations, Legal)
• Analyse historical incidents in your organisation
• Monitor external threats in your sector

Risk naming

A risk name is only useful if it's specific enough to act on: "Data breaches through phishing" beats "Cyber risk".

Clear conventions:

• Specific and measurable - "Data breaches through phishing" vs "Cyber risk"
• Organisation relevant - Focus on actual threats
• Consistent structure - Use fixed format per category
• Avoid jargon - Understandable for all stakeholders

Regular reviews

A risk register stays accurate only if someone revisits it on a fixed rhythm, not just after an incident.

Maintenance rhythm:

• Monthly check - Identify new risks (in very dynamic environments)
• Quarterly evaluation - Reassess existing risks
• Annual review - Examine complete risk portfolio
• Ad-hoc updates - After significant changes or incidents

Next steps

Now that you can create and manage risks:

• Perform systematic assessments for all identified risks
• Link effective controls to high risks
• Monitor treatment progress via dashboards
• Report regularly to management about risk profile

For operational guidance on assessments, see Conducting Risk Assessments.