# Track and treat risks

Record a risk, assign an owner, and update the residual score after checking that safeguards work.

## Record the risk

1. In the Compliance Portal, open **Risk register** and choose **Add risk**.
2. Name the event and describe its effect. For example, “Departed staff retain production access” can explain which systems are affected and what that access would allow.
3. Choose a category, a status, and a **Risk owner**. Add the person in **Contacts** first if they are missing.
4. Set **Likelihood** and **Impact** before accounting for safeguards. Dashio multiplies these two ratings by four to calculate the inherent score out of 100.

## Plan the treatment

Choose a **Treatment** and set a **Treatment due date**. Use **Mitigation actions** to record the work and how you will check it. In the departed-staff example, you could add a same-day access removal step and check a sample of completed departures against access logs.

Under **Linked controls**, choose the controls that support the treatment. If the required control is missing, [create it in Compliance & audit](/guides/compliance/controls-and-evidence). Choose **Create risk** to save the record.

## Review what remains

Open the record from the **Risk register** and review its owner, treatment, due date, and linked controls. After you check that the safeguards work, edit the risk and enter the **Residual risk score**. For example, a remaining likelihood of 2 and impact of 3 give a score of 24. If you leave the residual score blank, Dashio uses the inherent score.

Update the status and mitigation actions as work progresses. Return to **Overview → Response queue** to revisit open risks and risks with high residual exposure.