---

title: Troubleshooting & FAQ description: Frequently asked questions and solutions for risk-related issues in Tidal Control sidebar_position: 4

Troubleshooting & FAQ

Frequently Asked Questions

Why does my risk keep "Inactive" status?

A risk only becomes "Active" when all the following conditions are met:

• The "Valid from" date is in the past and "Valid to" in the future (or empty)
• At least one asset is linked to the risk

Solution:

1. Check validity period - Go to Details tab and set correct dates
2. Link Controls - Go to Rating tab and select relevant Controls under 'Treatment'
3. Refresh the page - Status update may require a browser refresh

How do I determine the correct likelihood and impact scores?

Estimating Likelihood:

• Use historical data - How often did this risk occur in the past?
• Analyze external factors - Threat landscape in your sector
• Consider current measures - What protection is already in place?
• Use the 'Ask TidalBot' button - to receive an immediate example assessment
• Consult experts - IT specialists, security advisors

Impact assessment:

• Financial consequences - Direct costs and revenue loss
• Operational disruption - Shutting down or slowing business operations
• Reputation damage - Media attention and customer trust
• Compliance impact - Fines and legal consequences

Consistency tips:

• Use the same criteria for all risks
• Document your assessment methodology
• Have multiple people assess independently
• Review scores periodically with fresh eyes

Which treatment option should I choose for my risk?

Reduce - Choose when:

• Risk has medium to high impact
• Effective measures are available
• Mitigation costs are proportional
• Organization has control over risk factors

Accept - Choose when:

• Risk has low impact and likelihood
• Mitigation costs more than potential damage
• Risk falls within accepted risk appetite
• No effective measures available

Transfer - Choose when:

• Risk has high financial impact
• Insurance or outsourcing is cost-effective
• Expertise for risk treatment is lacking
• Legal liability can be transferred

Avoid - Choose when:

• Risk has extreme impact
• Alternatives to risky activity exist
• Reputation risk is unacceptable
• Legal or ethical objections exist

Why am I not getting realistic AI assessments from TidalBot?

AI has limited context without organizational information:

• Add Organizational context - read more about this in Policies
• Fill in asset information completely - Systems, data, processes
• Describe specific circumstances in risk description
• Provide feedback on generated assessments

Improving AI results:

1. Add more context - More detailed descriptions
2. Link Assets - AI uses asset information for assessment
3. Fill in Attributes - Domain, category, threat group
4. Iterative refinement - Use AI output as starting point, then adjust

How do I effectively link controls to risks?

Selecting controls for "Reduce" treatment:

• Preventive controls - Prevent risk from occurring
• Detective controls - Early detection of risk manifestation
• Corrective controls - Restore after risk incident
• Compensating controls - Alternative protection

Estimating effectiveness:

• Direct relationship - Control addresses specific risk cause
• Proven effectiveness - Track record in similar situations
• Implementation quality - Is the control being executed correctly?
• Monitoring possible - Can you measure and adjust effectiveness?

Avoiding pitfalls:

• Not too many controls - Focus on most effective options
• Check overlap - Avoid redundant protection
• Consider costs - Proportionality between risk and mitigation
• Monitor residual risk - Assess if additional controls are needed

Common Problems

Residual risk higher than inherent risk

Problem: After linking controls, residual risk appears higher than the original risk.

Possible causes:

• Wrong assessment - Original estimate was too optimistic
• Poor implementation - Controls don't work as intended
• New threats - Risk has evolved since last assessment
• Control side effects - New vulnerabilities introduced

Solutions:

1. Review inherent risk - Was original assessment realistic?
2. Check controls - Are they being implemented correctly?
3. Update threat landscape - Have new threats emerged?
4. Find better controls - More effective alternatives available?

Risk assessment is inconsistent between assessors

Problem: Different people give very different scores to the same risk.

Causes:

• Unclear criteria - No shared understanding of likelihood/impact scales
• Different perspectives - IT vs Business vs Compliance viewpoint
• Lack of information - Assessors have different facts
• Personal bias - Risk appetite and experience influence judgment

Solutions:

1. Standardize criteria - Clear definitions per score level
2. Organize group sessions - Joint assessment and discussion
3. Calibration exercises - Train assessors with standard examples
4. Multiple perspectives - Have different experts assess

Assets are not correctly linked to risks

Problem: Asset linking appears random or incomplete.

Error scenarios:

• Too broad linking - All assets linked to every risk
• Too narrow linking - Critical exposure missed
• Outdated links - Assets not updated after changes
• Wrong granularity - Too detailed or too global

Best practices:

1. Specific linking - Only actually threatened assets
2. Regular reviews - Periodically update links
3. Think impact - Which assets actually affected in incident?
4. Stakeholder input - Involve asset owners in risk assessment

Risk treatment is not followed up

Problem: Chosen treatment is not implemented or monitored.

Causes:

• Unclear responsibilities - No one owns execution
• Lack of priority - Other work takes precedence
• Unrealistic plans - Treatment options are not executable
• No follow-up process - No systematic monitoring

Solutions:

1. Clear owners - Assign specific people to each treatment
2. Set deadlines - Concrete timelines for implementation
3. Regular check-ins - Quarterly reviews of treatment progress
4. Escalation process - Management involvement for delays

Technical Problems

Risk status is not updated

Problem: Changes in risk information don't reflect in the status.

Troubleshooting:

1. Clear browser cache - Hard refresh (Ctrl+Shift+R)
2. Save changes - By using the 'Update' button regularly
3. Don't ignore the 'Discard changes?' popup - If you navigate away from a screen without updating, you'll get the question to discard changes or go back to the risk (cancel). Go back to the risk and save changes first with the 'Update' button.

Come across an issue we haven't covered?

Send an email to support@tidalcontrol.com, and we'll get in touch as soon as possible.

Preventive Tips

Regular maintenance

Monthly tasks:

• Identify new risks - Have threats been added?
• Check status updates - Are all active risks still relevant?
• Treatment progress - Are planned measures being executed?

Quarterly reviews:

• Risk assessment updates - Are likelihood/impact scores still current?
• Asset links - New systems or changed exposure?
• Effectiveness assessment - Do chosen treatments work as expected?

Annual review:

• Complete portfolio review - Go through complete risk inventory
• Framework updates - New compliance requirements or standards?
• Stakeholder feedback - Input from asset owners and management

Maintaining data quality

Consistent input:

• Use attributes - Standard categories for filtering
• Avoid duplicates - Check existing risks before adding
• Clear descriptions - Understandable for all stakeholders
• Periodic cleanup - Archive outdated or irrelevant risks