Getting started with the Risk Register
Applies to user roles: Account Owner, Manager, User
Available on platforms: Vatix Workspace web app
The Risk Register gives your organisation one place to record the risks it is managing, score them before and after your controls, and see the whole picture on a single list. Scoring each Risk twice shows what your controls are worth, and the register colours every score, so you can tell at a glance where your exposure sits and which Risks are coming up for review.
Note: Risk Register is currently available to a limited number of organisations. If you don't see it in your left sidebar, contact your Account Owner. Account Owners can contact their Vatix account manager to find out more.
What you can do with the Risk Register
- Record a Risk with the person accountable for it, its status, a description and the date it is next due for review.
- Score each Risk twice, once before your existing controls and once after, so the value of those controls is visible.
- Read the whole register at a glance, with each Risk's scores shown as a coloured rating.
- Filter, sort and export the register, and add your own fields to match how your organisation records risk.
The Risk Register is available in Vatix Workspace on the web, and appears as 'Risk Register' in the left sidebar.
What a Risk record holds
Every Risk starts with the same standard fields, grouped into two sections on the record.
What 'Risk Information' holds
| Field | What it holds |
|---|---|
| Name | A short, descriptive name for the Risk |
| ID | A number assigned automatically, in sequence, when the Risk is created |
| Owner | The person accountable for managing the Risk |
| Status | How far the Risk has progressed |
| Next review date | The date the Risk is next due to be looked at |
| Description | A fuller explanation of the Risk and how it could materialise |
What 'Risk Scoring' holds
| Field | What it holds |
|---|---|
| Inherent risk | The rating before your existing controls are taken into account |
| Residual risk | The rating after your existing controls are taken into account |
How a Risk is scored
Both ratings use the same five by five matrix. You pick one square, combining how likely the risk is with how severe it would be, and Vatix works out the score and its rating for you. Scoring the same Risk twice, inherent and residual, shows how far your controls bring it down.
You can create a Risk before you have scored it, and add either rating later.
See 'How to score a Risk' for the matrix, the score ranges and what each rating means.
The statuses a Risk moves through
A new Risk is created as 'Open'. You can move it through five statuses as it progresses:
- Open
- In progress
- Mitigated
- Accepted
- Closed
Status is a field on the Risk, so you can filter and sort the register by it.
Who can access and manage Risks?
A Risk Register licence is what gives you the module, and it is assigned per person. Anyone holding one sees every Risk in your organisation and can create and edit them, whatever their role. Deleting a Risk, assigning licences and configuring the Risk object are the parts that depend on your role or on the access you have been given.
| Your role or access | What you can do |
|---|---|
| Account Owner | View, create, edit and delete Risks, and assign Risk Register licences to other people |
| Manager | View, create, edit and delete Risks |
| User | View, create and edit Risks |
| Object Manager, alongside any role | Everything your role allows, plus 'Field Manager' and 'Layout Editor' for the Risk object under 'Settings' > 'Objects' > 'Risks' |
Object Manager access is set per person and is separate from your role, so a Manager or a User can hold it. You need a Risk Register licence as well before 'Risks' appears under 'Settings' > 'Objects'.
Your Account Owner assigns a Risk Register licence from your profile, and can see how many licences your organisation holds. See how to assign and unassign product licences.
How to add your own fields to Risk records
Like Sites, Assets and Contacts, Risks are configurable through Object Manager. Go to 'Settings' > 'Objects' > 'Risks', then use 'Field Manager' to add the fields your organisation records against a risk, and 'Layout Editor' to arrange the sections and fields on the record. A field you add appears on the Risk record and as a column you can show in the register.
See Getting started with the Object Manager, how to manage the Field Manager and how to manage the Layout Editor.
The 'Risk Scoring' section is marked 'Fixed' and always sits at the bottom of the layout, so the two ratings stay in the same place on every Risk. Everything above it is yours to arrange.
Related articles