# Creating and editing risks

> The risk record itself rather than its scores. Creating it, classifying it, linking the assets it threatens and the controls that treat it, and its owner.

Source: https://tidalcontrol.com/docs/risks/creating-and-editing-risks

This article covers the risk record itself rather than its scores: creating it, classifying it, linking the assets it threatens and the controls that treat it, assigning an owner, and archiving it when it no longer applies. For scoring, see [Conducting Risk Assessments](/docs/risks/assessing-risks).

## Adding new risks

A risk needs only a name to exist; classification, links, and scores can all follow later.

### Creating a risk

1. **Go to the Risks page** via the main menu
2. **Click "Add risk"** in the top right of the overview
3. **The creation form opens** where you can fill in risk information

![Creating new risk](/images/help/risks_add_risk.png)

### Filling in risk information

Only the name is required; a custom ID and owner can be added now or later.

**Required fields:**
- **Name** - Choose a clear, descriptive name for the risk
- For example: "Malware installation on systems" or "Insufficient management involvement"

**Optional fields:**
- **Custom ID** - Your own reference number (e.g. "R.IT.01", "R.HR.03")
- **Assign owner** - Select the responsible person from the dropdown
- **Description** - Explain what this risk entails and why it's relevant

> **tip:**

**Clear naming**: Use names that directly indicate what the risk involves. Avoid vague terms and focus on concrete threats to your organisation.

### Saving the risk

1. **Check all entered information**
2. **Click "Create"** to create the risk
3. **The new risk appears** in your overview with initial status

## Editing risk information

The detail panel holds the risk's own fields and its classification attributes.

### Opening risk details

1. **Click on a risk name** in the overview
2. **Select the "Details" tab** in the risk interface
3. **All editable fields** are displayed

![Risk details page](/images/help/risks_details_page.png)

### Adjusting basic information

Once created, a risk's name, validity period, appetite, and description can all still be changed.

**Editable fields in Details tab:**
- **Name** - Adjust risk name
- **Custom ID** - Change for better reference  
- **Valid from / Valid to** - Set validity period
- **Risk Appetite** - Determine acceptable risk levels
- **Description** - Extended risk description

**How to edit information:**
1. **Click in the relevant field**
2. **Adjust the text or date**
3. **Click the Update button** on the left bottom or top right of the screen to save changes

### Risk classification

Attributes let you tag a risk with the domain, category, or threat group it belongs to.

**Adding attributes:**
1. **Scroll to "Attributes" section**
2. **Click "Add attribute"** 
3. **Enter a title** (e.g. "DOMAIN", "RISK CATEGORY")
4. **Enter a value** (e.g. "Equipment", "Information risk")
5. **Attributes help** with filtering and reporting

**Examples of useful attributes:**
- **DOMAIN** - IT, HR, Finance, Operations
- **THREAT GROUP** - Cyber, Physical, Personnel, External
- **IMPACT TYPE** - Financial, Reputation, Operational, Compliance

> **info:**

**Consistent attributes**: Reuse existing titles and values from the dropdown list to prevent typos and make filters effective.

## Linking assets to risks

Linking assets records what the risk actually threatens, which in turn suggests which controls belong on it.

### Why link assets?

By linking business assets, you establish which systems, data or processes are threatened by this risk.

### Selecting assets

1. **Go to the "Assets" section** in the Details tab of the risk
2. **View available assets** in the list
3. **Select relevant assets** by checking checkboxes
4. **Links are automatically saved**

![Assets linked to risk](/images/help/risks_detail_assets.png)

**Selection criteria:**
- **Direct exposure** - Asset is directly threatened by this risk
- **Critical dependency** - Asset is essential for business operations
- **Data sensitivity** - Asset contains confidential information
- **Compliance impact** - Asset falls under regulations

> **tip:**

When conducting risk assessments, linked assets should be included in impact calculations. Therefore, only link assets that are actually affected by this specific risk.

## Owners and responsibilities

A risk needs an owner before its assessment can move past Not assigned.

### Assigning risk owners

The owner is the person ultimately accountable for how the risk is managed.

**Setting Owners:**
1. **Find "Owners" section** on the right side of Details tab
2. **Click the user icon**
3. **Type username** and select from dropdown
4. **Multiple owners possible** for shared responsibility

**Assigning Executors:**
- People who perform executive tasks for risk treatment
- Often operational staff or specialists
- (future feature) Automatically assigned to new manual tasks

**Appointing Assessors:**
- People who perform risk assessment tasks  
- Usually risk managers or compliance officers
- Independent from implementation team
- (future feature) Automatically assigned to new risk assessment tasks

> **warning:**

**Owner vs Executor**: Owners are ultimately responsible for risk management, Executors perform specific tasks. Ensure clear separation of responsibilities.

## Managing risk lifecycle

A risk has to be activated before it counts, and archiving keeps its history when it stops applying. Deleting does not.

### Risk activation

Inactive risks currently have no impact on application functionality. 

(future feature) In the future, risk assessments will only be scheduled for active risks. 

**A risk becomes "Active" when:**
- The "Valid from" date is in the past
- The "Valid to" date is in the future (or empty)
- Controls are linked to the risk

**Active risks:**
- (future feature) Will be included in scheduled risk assessments
- Visible in dashboards and reports

### Risk archiving

Archive a risk once it's genuinely no longer relevant, rather than deleting it, so the history survives.

**When to archive:**
- Risk is no longer relevant
- Business activity causing the risk has stopped
- External circumstances make risk irrelevant
- Risk has been merged with another risk

**Archiving process:**
1. **Select one or multiple risks** with checkboxes in overview
2. **Click "Archive" button** at top of table  
3. **Confirm archiving** - risks disappear from daily overview
4. **Historical data** remains available for audit

**Effect of archiving:**
- Risk appears in "Archived" tab
- All links remain preserved but hidden
- No new assessments or treatments
- Reports don't account for archived risks

### Risk deletion

Delete a risk only when it should never have existed: a test entry, a duplicate, or data that must not be retained.

**When to delete:**
- Test risk with incorrect information
- Duplicate risk accidentally created
- Sensitive information that must not be retained
- Organisation requires permanent deletion

**Deletion process:**
1. **Select risks** with checkboxes
2. **Click "Delete" button** at top of table
3. **Confirm permanent deletion** - irreversible action
4. **All linked data** is completely erased

> **warning:**

**Archive vs Delete**: Use archiving for risks that are no longer relevant but have historical value. Only delete for technical errors or data privacy requirements.

## Planning risk treatment

Once treatment is decided, the linked controls are what carry it out, so their effectiveness is what you monitor from here on.

### Linking treatment strategies

Treatment is set from the risk's own Assessment tab, and choosing Reduce is what requires you to link controls.

**After risk assessment:**
1. **Go to the "Assessment" tab** of the risk
2. **Select or change treatment option** (Reduce, Accept, Transfer, Avoid)
3. **For "Reduce"** - Link relevant controls
4. **Add justification** in comments field

### Monitoring control effectiveness

Treatment isn't a one-time decision. Check periodically whether the linked controls still hold up against new threats.

**Ongoing evaluation:**
- **Regularly check** if linked controls are effective
- **Update risk assessment** when circumstances change
- **Adjust treatment** for new threats
- **Changes are automatically documented** in Feed tab

## Bulk operations

Selecting several risks at once lets you apply the same owner, attribute, or archive action to all of them.

### Managing multiple risks simultaneously

Bulk actions cover archiving and deleting, not owner or attribute changes.

**Available bulk operations:**
- **Archive** - Move multiple risks to archive
- **Delete** - Permanently delete selected risks

**Bulk workflow:**
1. **Select risks** with checkboxes on left in overview
2. **Relevant buttons appear** at top of table
3. **Choose desired action** and confirm

**Not possible for bulk:**
- Edit risk descriptions
- Manage attributes
- Adjust asset links
- Report on selected risks

## Risk reporting

Export the risk register when you need it outside Tidal, for management reporting or an audit.

### Using export functionality

The exported file is a snapshot at that moment, not a live sync.

**Generating risk report:**
1. **Click "Export report"** in top right of overview
2. **Excel file** is downloaded with:
   - Risk names and IDs
   - Inherent and residual risk scores
   - Treatment status and linked controls
   - Asset links
   - Control effectiveness per linked Risk

**Reporting applications:**
- **Management presentations** about risk profile
- **Audit documentation** for compliance
- **Trend analysis** over time
- **Benchmark comparison** with previous periods
- **Monitor impact of ineffective controls** on current residual risks

## Best practices for risk management

A risk register stays usable when risks are identified from more than one source, named consistently, and reviewed on a fixed rhythm.

### Risk identification

Risks surface fastest when more than one perspective looks for them, not just the person filling in the register.

**Systematic approach:**
- **Use templates** for standard risks
- **Involve different perspectives** (IT, HR, Operations, Legal)
- **Analyse historical incidents** in your organisation
- **Monitor external threats** in your sector

### Risk naming

A risk name is only useful if it's specific enough to act on: "Data breaches through phishing" beats "Cyber risk".

**Clear conventions:**
- **Specific and measurable** - "Data breaches through phishing" vs "Cyber risk"
- **Organisation relevant** - Focus on actual threats
- **Consistent structure** - Use fixed format per category
- **Avoid jargon** - Understandable for all stakeholders

### Regular reviews

A risk register stays accurate only if someone revisits it on a fixed rhythm, not just after an incident.

**Maintenance rhythm:**
- **Monthly check** - Identify new risks (in very dynamic environments)
- **Quarterly evaluation** - Reassess existing risks  
- **Annual review** - Examine complete risk portfolio
- **Ad-hoc updates** - After significant changes or incidents

> **tip:**

**Start small, build out**: Assess all risks, but limit monitoring to the most critical risks for your organisation. Gradually add more risks as your process matures.

## Next steps

Now that you can create and manage risks:
- **Perform systematic assessments** for all identified risks
- **Link effective controls** to high risks
- **Monitor treatment progress** via dashboards
- **Report regularly** to management about risk profile

For operational guidance on assessments, see [Conducting Risk Assessments](/docs/risks/assessing-risks).