Getting started with the Risk Register
Applies to user roles: Account Owner, Manager, User
Available on platforms: Vatix Workspace web app
The Risk Register gives your organisation one place to record the risks it is managing and the controls that reduce them. You can score each Risk before and after your controls, and you can also set a target risk rating. The register colours every score, so you can see at a glance where your exposure sits and which Risks are coming up for review.
What you can do with the Risk Register
- Record a Risk with the person accountable for it, its status, a description and the date it is next due for review.
- Score each Risk before and after your existing controls, so the value of those controls is visible, and set the target level you are aiming for.
- Keep a Controls library of the measures your organisation uses to reduce risk, each with an owner, a category and a status.
- Add controls from the library to a Risk, so you can see which controls are reducing the Risk.
- Propose a new control with a due date. Its owner gets a control action to put it in place.
- Keep the discussion, the evidence and a full history with each Risk, in the activity feed beside the record and its 'Attachments' and 'History' tabs.
- Read the whole register at a glance, with each Risk's scores shown as a coloured rating.
- Filter, sort and export the register, and add your own fields to match how your organisation records risk.
The Risk Register is available in Vatix Workspace on the web, and appears as 'Risk Register' in the left sidebar. It has two pages: 'Risk register', which lists your Risks, and 'Controls library'.
What a Risk record holds
The top of every Risk record shows its owner, status, next review date, and its inherent and residual scores.
Below that, the record has six tabs: 'Details', 'Controls', 'Risk Scoring', 'Attachments', 'History' and 'Related'.
What the 'Details' tab holds
| Field | What it holds |
|---|---|
| Name | A short, descriptive name for the Risk |
| ID | A number assigned automatically, in sequence, when the Risk is created |
| Owner | The person accountable for managing the Risk |
| Status | How far the Risk has progressed |
| Next review date | The date the Risk is next due to be looked at |
| Description | A fuller explanation of the Risk and how it could materialise |
What the 'Controls' tab holds
The 'Controls' tab lists the controls added to the Risk. Each row shows the control's category, status, owner and due date.
What the 'Risk Scoring' tab holds
| Field | What it holds |
|---|---|
| Inherent risk | The rating before your existing controls are taken into account |
| Residual risk | The rating after your existing controls are taken into account |
| Target risk | The level you are aiming for once your controls are in place |
How a Risk is scored
All three ratings use the same five by five matrix. You pick one square, combining how likely the risk is with how severe it would be, and Vatix works out the score and its rating for you. Scoring inherent and residual risk shows how far your controls bring it down, and the target shows how far there is still to go.
You can create a Risk before you have scored it, and add any of the ratings later.
See 'How to score a Risk' for the matrix, the score ranges and what each rating means.
The statuses a Risk moves through
A new Risk is created as 'Open'. You can move it through five statuses as it progresses:
- Open
- In progress
- Mitigated
- Accepted
- Closed
Status is a field on the Risk, so you can filter and sort the register by it.
How controls work
A control is a measure that reduces a risk, such as a training course or a daily inspection. Your organisation keeps its controls in the 'Controls library', so you can add the same control to more than one Risk.
Each control has an ID, a name, a description, a category, an owner and a status. The status is 'In place' or 'Proposed'. A 'Proposed' control also has a due date.
A control's details are the same on every Risk it is added to. To change them, open the control in the 'Controls library'.
When a control is 'Proposed', its owner gets a control action, due on the due date.
Account Owners can manage the categories in the 'Controls library'.
Who can access and manage Risks?
A Risk Register licence is what gives you the module, and it is assigned per person. Anyone holding one sees every Risk in your organisation and can create and edit them, whatever their role. Deleting a Risk, assigning licences and configuring the Risk object are the parts that depend on your role or on the access you have been given.
| Your role or access | What you can do |
|---|---|
| Account Owner | View, create, edit and delete Risks, and assign Risk Register licences to other people |
| Manager | View, create, edit and delete Risks |
| User | View, create and edit Risks |
| Object Manager, alongside any role | Everything your role allows, plus 'Field Manager' and 'Layout Editor' for the Risk object under 'Settings' > 'Objects' > 'Risk Register' |
Anyone with a Risk Register licence can view the 'Controls library' and add new controls to it. Account Owners and Managers can also edit and archive controls, and add controls to a Risk.
Object Manager access is set per person and is separate from your role, so a Manager or a User can hold it. You need a Risk Register licence as well before 'Risk Register' appears under 'Settings' > 'Objects'.
Your Account Owner assigns a Risk Register licence from your profile, and can see how many licences your organisation holds. See how to assign and unassign product licences.
How to add your own fields to Risk records
Like Sites, Assets and Contacts, Risks are configurable through Object Manager. Go to 'Settings' > 'Objects' > 'Risk Register', then use 'Field Manager' to add the fields your organisation records against a risk, and 'Layout Editor' to arrange the sections and fields on the record. A field you add appears on the Risk record and as a column you can show in the register.
See Getting started with the Object Manager, how to manage the Field Manager and how to manage the Layout Editor.
The 'Risk Scoring' section is marked 'Fixed' and always sits at the bottom of the layout, so the ratings stay in the same place on every Risk. Everything above it is yours to arrange.
Related articles