The method is the same whether the risk comes from an audit, an incident, or a review. You name it, you score it as it stands, you attach what already reduces it, you score what remains, and you record the decision.
Name the risk
Start on the risk register and open a risk. Details hold what the risk is, its type, its source, and its status. Those lists are yours: risk types, sources, and statuses are maintained in configuration, along with common threats you want people to reuse.
Assets are the things the risk can harm. Link the assets from the asset register so the risk is not an abstract sentence. Notes hold the working commentary that should stay with the risk.
Score it before controls
Inherent likelihood and inherent impact are the risk before you take credit for controls. The rating is derived from the likelihood by impact matrix. You do not type a separate score and then ignore the matrix. Open the matrix when you need to see which band a pair of values falls into.
Likelihood is how probable the event is. Impact is how bad it would be. Use the same scales for every risk, or the register cannot be compared.
Attach what already reduces it
Controls are the implemented controls that address this risk. Linking them is what lets the residual score mean something. A control that is not linked is not part of this assessment, even if it exists on the control register.
Control categories, control statuses, control effectiveness, and monitoring frequency are configuration lists. Effectiveness and monitoring describe the control. They are not a substitute for the residual score on the risk.
Score what remains
Residual likelihood and residual impact are the risk after those controls. The residual rating is derived the same way, from the matrix. If the residual score is still higher than the organisation will live with, the response cannot honestly be to do nothing.
Record the decision
Acceptance is not a way to skip the assessment. The inherent score, the controls, and the residual score should already be there. Activity keeps the history of those changes.
- Treat. You will reduce the risk further. The evaluation date sits on the response. The actions and the proof sit under Treatment and evidence.
- Accept. The remaining risk is inside appetite. Record who accepted it, the reason, the evaluation date, and the date the acceptance is valid until.
- Avoid. You will stop the activity that creates the risk. Notes explain what is being stopped.
- Transfer. Someone else carries part of the risk, for example through insurance. Record the arrangement and when the next assessment is due.
Failures and improvements
A non-conformity is a requirement that was not met. It has its own details, corrective actions, related links, evidence, notes, and activity. An improvement opportunity is a change you want to make that is not itself a non-conformity. Both can be raised from other work, including an audit, and both stay on this module so the risk register is not the only place a finding can live.
The risk record and the guides beside it are the screens for each of these steps.