---

title: Creating and editing risks description: Learn how to add new risks and manage existing risks for effective risk management sidebar_position: 3

Creating and editing risks

Adding new risks

Creating a risk

1. Go to the Risks page via the main menu
2. Click "Add Risk" in the top right of the overview
3. The creation form opens where you can fill in risk information

Filling in risk information

Required fields:

• Name - Choose a clear, descriptive name for the risk
• For example: "Malware installation on systems" or "Insufficient management involvement"

Optional fields:

• Custom ID - Your own reference number (e.g. "R.IT.01", "R.HR.03")
• Assign owner - Select the responsible person from the dropdown
• Description - Explain what this risk entails and why it's relevant

Saving the risk

1. Check all entered information
2. Click "Create" to create the risk
3. The new risk appears in your overview with initial status

Editing risk information

Opening risk details

1. Click on a risk name in the overview
2. Select the "Details" tab in the risk interface
3. All editable fields are displayed

Adjusting basic information

Editable fields in Details tab:

• Name - Adjust risk name
• Custom ID - Change for better reference
• Valid from / Valid to - Set validity period
• Risk Appetite - Determine acceptable risk levels
• Description - Extended risk description

How to edit information:

1. Click in the relevant field
2. Adjust the text or date
3. Click the Update button on the left bottom or top right of the screen to save changes

Risk classification

Adding attributes:

1. Scroll to "Attributes" section
2. Click "Add attribute"
3. Enter a title (e.g. "DOMAIN", "RISK CATEGORY")
4. Enter a value (e.g. "Equipment", "Information risk")
5. Attributes help with filtering and reporting

Examples of useful attributes:

• DOMAIN - IT, HR, Finance, Operations
• THREAT GROUP - Cyber, Physical, Personnel, External
• IMPACT TYPE - Financial, Reputation, Operational, Compliance

Linking assets to risks

Why link assets?

By linking business assets, you establish which systems, data or processes are threatened by this risk.

Selecting assets

1. Go to "Assets" tab of the risk
2. View available assets in the list
3. Select relevant assets by checking checkboxes
4. Links are automatically saved

Selection criteria:

• Direct exposure - Asset is directly threatened by this risk
• Critical dependency - Asset is essential for business operations
• Data sensitivity - Asset contains confidential information
• Compliance impact - Asset falls under regulations

Owners and responsibilities

Assigning risk owners

Setting Owners:

1. Find "Owners" section on the right side of Details tab
2. Click the user icon
3. Type username and select from dropdown
4. Multiple owners possible for shared responsibility

Assigning Executors:

• People who perform executive tasks for risk treatment
• Often operational staff or specialists
• (future feature) Automatically assigned to new manual tasks

Appointing Assessors:

• People who perform risk assessment tasks
• Usually risk managers or compliance officers
• Independent from implementation team
• (future feature) Automatically assigned to new risk assessment tasks

Managing risk lifecycle

Risk activation

A risk becomes "Active" when:

• The "Valid from" date is in the past
• The "Valid to" date is in the future (or empty)
• Controls are linked to the risk

Active risks:

• (future feature) Will be included in scheduled risk assessments
• Visible in dashboards and reports

Risk archiving

When to archive:

• Risk is no longer relevant
• Business activity causing the risk has stopped
• External circumstances make risk irrelevant
• Risk has been merged with another risk

Archiving process:

1. Select one or multiple risks with checkboxes in overview
2. Click "Archive" button at top of table
3. Confirm archiving - risks disappear from daily overview
4. Historical data remains available for audit

Effect of archiving:

• Risk appears in "Archived" tab
• All links remain preserved but hidden
• No new assessments or treatments
• Reports don't account for archived risks

Risk deletion

When to delete:

• Test risk with incorrect information
• Duplicate risk accidentally created
• Sensitive information that must not be retained
• Organization requires permanent deletion

Deletion process:

1. Select risks with checkboxes
2. Click "Delete" button at top of table
3. Confirm permanent deletion - irreversible action
4. All linked data is completely erased

Planning risk treatment

Linking treatment strategies

After risk assessment:

1. Go to "Rating" tab of the risk
2. Select or change treatment option (Reduce, Accept, Transfer, Avoid)
3. For "Reduce" - Link relevant controls
4. Add justification in comments field

Monitoring control effectiveness

Ongoing evaluation:

• Regularly check if linked controls are effective
• Update risk assessment when circumstances change
• Adjust treatment for new threats
• Changes are automatically documented in Feed tab

Bulk operations

Managing multiple risks simultaneously

Available bulk operations:

• Archive - Move multiple risks to archive
• Delete - Permanently delete selected risks

Bulk workflow:

1. Select risks with checkboxes on left in overview
2. Relevant buttons appear at top of table
3. Choose desired action and confirm

Not possible for bulk:

• Edit risk descriptions
• Manage attributes
• Adjust asset links
• Report on selected risks

Risk reporting

Using export functionality

Generating risk report:

1. Click "Export Report" in top right of overview
2. Excel file is downloaded with:
   • Risk names and IDs
   • Inherent and residual risk scores
   • Treatment status and linked controls
   • Asset links
   • Control effectiveness per linked Risk

Reporting applications:

• Management presentations about risk profile
• Audit documentation for compliance
• Trend analysis over time
• Benchmark comparison with previous periods
• Monitor impact of ineffective controls on current residual risks

Best practices for risk management

Risk identification

Systematic approach:

• Use templates for standard risks
• Involve different perspectives (IT, HR, Operations, Legal)
• Analyze historical incidents in your organization
• Monitor external threats in your sector

Risk naming

Clear conventions:

• Specific and measurable - "Data breaches through phishing" vs "Cyber risk"
• Organization relevant - Focus on actual threats
• Consistent structure - Use fixed format per category
• Avoid jargon - Understandable for all stakeholders

Regular reviews

Maintenance rhythm:

• Monthly check - Identify new risks (in very dynamic environments)
• Quarterly evaluation - Reassess existing risks
• Annual review - Examine complete risk portfolio
• Ad-hoc updates - After significant changes or incidents

Next steps

Now that you can create and manage risks:

• Perform systematic assessments for all identified risks
• Link effective controls to high risks
• Monitor treatment progress via dashboards
• Report regularly to management about risk profile

For operational guidance on assessments, see Conducting Risk Assessments.