Track and treat risks
Record a risk, assign an owner, and update the residual score after checking that safeguards work.
Record the risk
- In the Compliance Portal, open Risk register and choose Add risk.
- Name the event and describe its effect. For example, “Departed staff retain production access” can explain which systems are affected and what that access would allow.
- Choose a category, a status, and a Risk owner. Add the person in Contacts first if they are missing.
- Set Likelihood and Impact before accounting for safeguards. Dashio multiplies these two ratings by four to calculate the inherent score out of 100.
Plan the treatment
Choose a Treatment and set a Treatment due date. Use Mitigation actions to record the work and how you will check it. In the departed-staff example, you could add a same-day access removal step and check a sample of completed departures against access logs.
Under Linked controls, choose the controls that support the treatment. If the required control is missing, create it in Compliance & audit. Choose Create risk to save the record.
Review what remains
Open the record from the Risk register and review its owner, treatment, due date, and linked controls. After you check that the safeguards work, edit the risk and enter the Residual risk score. For example, a remaining likelihood of 2 and impact of 3 give a score of 24. If you leave the residual score blank, Dashio uses the inherent score.
Update the status and mitigation actions as work progresses. Return to Overview → Response queue to revisit open risks and risks with high residual exposure.
Was this helpful?