Risks

The risk register is where your organisation records what could go wrong, scores it, decides what to do about it, and keeps a history an auditor can follow.

A risk is something that could harm your operations, assets or compliance position before it turns into an incident. You give each one an owner, a review date and a treatment decision, and drive it to a settled state; changes are written to the audit log. The register sits in the Risks group of the left menu, at /risks, and each risk has its own page at /risks/{id}.

Who uses it

Everyone signed in can read the register. A Viewer sees the list, the charts and the detail pages, but the create, import, treatment and status controls are hidden rather than shown and refused; the read-only AI actions — Smart Triage (AI) and the acceptance Review (AI) — stay available. A Contributor adds risks, imports a spreadsheet, records treatment and residual figures, changes status and runs the AI assists that write to a risk. A Manager also deletes risks, singly or in bulk, and maintains what the register depends on: the methodologies (which carry the severity bands), the risk templates, the appetite and the groupings. An Admin has all of that plus the wider organisation settings. Risk categories are not edited from a screen here.

How risks are scored

Aegis stores the inherent score — impact × likelihood, before treatment — and works out the band name at display time, so changing the bands relabels risks you already hold. The size of the grid comes from the risk's methodology: 3 × 3, 4 × 4 or 5 × 5. On the standard five-level grid, impact runs Minimal to Critical and likelihood Rare to Almost Certain, giving 1 to 25; a smaller grid gives a lower top score, and its score bands are scaled to fit. Beside it sits the residual score: what remains after treatment. The bands come from your default risk methodology; the legend on the detail page in the capture reads:

What's on this screen

A toolbar sits above everything: Smart Triage (AI) on the left, a Show Visualizations toggle on the right. The charts are collapsed in the capture, so the table appears sooner; opening them reveals a heatmap drawn on your default methodology's grid and a risks-by-category chart. Below sits the Portfolio FAIR exposure card with an aggregate median annual loss figure (P50 ALE) — €45,388.52 here — then a right-aligned row of register-wide actions (Manage groupings, New risk (guided), Export register, Import) and the page header Risk Register, with Add Risk at the far right.

The filter bar runs over two rows — All Statuses, All Categories, All Severities, All Methodologies, All Treatments, then All levels and All PDCA phases — above a Search risks… box with its own Search button. The table has a select-all checkbox and, reading across: Title, Category, Status (a coloured chip — Accepted and In Progress in the capture), Methodology, Level, Groupings, Treatment, Inherent Score (the number with its band, such as 20 (Very high)), Residual and PDCA phase. An unset value shows an em dash — in the capture that is every visible row from Methodology to Treatment. The table scrolls sideways, faded edges marking more to come: action progress, links, owner, next review and the row actions sit beyond the right edge. Ticking row checkboxes raises a bulk bar with Delete, Change Status, Change methodology and Export. A Needs re-assessment tick box beside the filters lists only the risks scored above their methodology's levels; those rows carry the same badge in the Methodology column.

Finding and opening a risk

1. Select Smart Triage (AI) to open the triage panel. It ranks your open and in-progress risks and explains the order; nothing on a risk changes.
2. Select Show Visualizations to expand the heatmap and the category chart. The label becomes Hide Visualizations, and selecting a populated heatmap cell opens a small list of the risks in that cell, each a link to its page.
3. Select New risk (guided) for the seven-step wizard covered next; the register refreshes once the risk is created.
4. Select Add Risk for the shorter form instead — title, description, category, governance level, grouping, impact, likelihood, treatment, owner and a review date, with a score preview that updates as you set the scales. The scales show the levels of your default methodology. Choosing a treatment adds a required Justification box; if the save is refused, the message names the reason and the field at fault is highlighted.
5. Choose a band under All Severities to narrow the table. The choice is written into the page address, so a filtered view can be shared by copying the URL; the other dropdowns work the same way.
6. Type into Search risks… and select Search to match on the title or the description. Select a title in the table, or the eye icon at the end of the row, to open that risk at /risks/{id}.

Creating a risk with the guided wizard

New risk (guided) opens a seven-step dialog. Its subtitle names the current step and position — Template & methodology · 1/7 in the capture — above a seven-segment progress bar; the footer holds Back and Next.

1. Choose a Methodology. The list holds those configured for your organisation, one marked (default) — Default Risk Methodology (default) here. It sets the impact dimensions you score later and the treatments permitted per band.
2. Optionally select a card under Start from a template (optional) to pre-fill the risk; the capture offers one, Alfa. With no templates, the step says so and you build the risk from scratch.
3. Select Next to move on to Describe. Back is inactive on this first step, and from here Next stays inactive until the step's required fields are filled.

The remaining six steps

1. Describe asks for the Risk title, which is required, and a Description.
2. Characterise takes the Category — also required — and, if the methodology defines any, the threat actors or sources behind the risk.
3. Assess takes the likelihood and the impact for each dimension the methodology defines, aggregating those into one overall impact as you go.
4. Score states the inherent score and its band against your configured risk appetite — “Within appetite”, or “Above appetite … treatment expected” — and the methodology matrix below highlights the cell you have landed in.
5. Treatment takes one choice or Decide later. A chosen treatment needs a Rationale; one the methodology forbids for that band is refused with an explanation, and one that needs authorisation shows a sign-off tick box.
6. Review & own takes the Owner and the Next review date. The owner attests mitigations and can formally accept the risk, so creating a risk does not make you its owner unless you hold risk-acceptance authority (a Manager or Admin). With that authority you can leave the owner on Me; without it you must name someone else, and the risk is not created until you do. Select Create risk and it appears in the table.

Importing and exporting the register

1. Select Import, then Download template to get risk-import-template.xlsx. Fill it in outside Aegis. Open Columns and accepted values in the dialog for every column's exact header, whether it is required, the values it accepts and an example; a .csv upload must use the same headers on line 1.
2. Attach the completed file — .xlsx or .csv — and select Validate. Aegis reports how many rows are valid and lists each problem by row number, without writing anything.
3. Select Import n valid row(s) to write them; only rows with no errors are imported. The dialog reports how many risks were created and updated, and the register refreshes behind it.
4. To update risks in bulk, fill in the Risk ID column: it is the first column of an Excel or CSV export. A row with a Risk ID updates that risk instead of creating one. Only the cells you fill in change, blank cells keep the stored value, and the scores are recalculated. Validate shows how many rows will be created and how many updated; an unknown or repeated Risk ID is reported as a row error.
5. For the other direction, select Export register and choose Export as Excel or Export as CSV; the export honours the filters currently applied. For a hand-picked set, tick the rows and use Export on the bulk bar, which downloads a CSV of only those risks.

Working on a risk: the detail page

All treatment work happens on the risk's own page; there is no edit dialog. A breadcrumb leads back to Risk Register, and the title line carries the status chip, with the valid next statuses as buttons on the right — Open and In Progress for the accepted risk in the capture. The left column runs Description, then Inherent Risk and Residual Risk side by side (each a score and band, with the Impact 4 × Likelihood 5 arithmetic under the inherent one), Risk heatmap position with its band legend, AI Enrichment, the AI treatment plan button, and below those the CVE links, the linked items and the mitigating actions. The right column stacks Details, Assessment (impact and likelihood as dot scales), Treatment, Acceptance and Dates.

1. In Residual Risk, select the pencil to pin a figure by hand. A number field opens, hinted 1 to the inherent score; type the figure and select Save. The card and the register's Residual column update. Aegis otherwise derives residual from the reductions on implemented mitigating actions, so pin a figure only where your judgement differs from what those actions model.
2. Select Add likelihood rationale under Assessment to say why this likelihood was chosen. A text box opens; once saved, the link becomes an edit control. The dot scales themselves are read-only here.
3. In Treatment, open the dropdown and choose Accept, Mitigate, Transfer, Insure or Avoid — a risk with no decision reads Not decided, as in the capture. A Justification box appears and must be filled in.
4. Select Save & apply. The badge above the dropdown changes to the chosen treatment and the justification is stored with it. Nothing is saved until you select it.
5. Select Enrich with AI for an analysis. It arrives with a confidence badge — Very Low confidence in the capture — and, where no external sources were retrieved, a note that the figures are AI-generated estimates to check before citing them.
6. In Acceptance — a card that appears only once a risk has been accepted — select Review (AI) to have Aegis comment on the recorded justification and review date; the pencil beside it edits both by hand. Where the acceptance predates this record-keeping, the card says no details were recorded and asks for a formal re-accept, as in the capture.

Moving risks to another methodology

Every risk is scored under one methodology. A risk created without one, by any route, is stored under your organisation's default methodology, and risks recorded before that rule are linked to the default too. To move risks to a different methodology:

1. Tick the risks in the register and select Change methodology on the bulk bar. A dialog opens.
2. Choose the methodology and select Change methodology. The risks are linked to it; their scores are not changed.
3. Read the notices that follow. A risk whose impact or likelihood is above the new methodology's levels (a 5 on a 4 × 4 grid, for example) is flagged Needs re-assessment, in the register and as a notice on its detail page. An accepted or signed-off risk moves only when you are its owner or hold risk-acceptance authority; the others stay where they were and are counted in a warning.

Re-assess a flagged risk through Edit on its detail page. The methodologies themselves are kept under Risk Methodologies at /risks/methodologies, where Levels per axis sets a grid of 3 × 3, 4 × 4 or 5 × 5. Changing the number of levels resizes both scales and rescales the score bands; existing risks keep their scores.

Status, acceptance and exceptions

A risk moves through four statuses: Open (no treatment under way), InProgress (treatment started), Mitigated (treatment complete, residual exposure acceptable) and Accepted (your organisation has decided to live with it). The buttons offer only the valid moves — from Open you can reach In Progress or Accepted, but not Mitigated directly; from Accepted, as in the capture, you can reopen or restart treatment. Accepting is a formal act: Aegis asks for a justification and, optionally, a date by which the acceptance must be re-reviewed, then lists the risk on the exceptions register with who accepted it and when, and flags that review when it falls due.

The AI assists

Four AI features touch this module, all advisory. Smart Triage ranks the top ten of your open and in-progress risks by severity, overdue review and residual exposure, then narrates that order: Aegis computes the ranking and the model may not reorder it. Enrich with AI returns threat context, related CVEs, suggested mitigations and control recommendations. AI treatment plan proposes new mitigating actions, each with an estimated likelihood or impact reduction; creating one is a separate step you take. Review (AI) comments on an acceptance justification and its review date. None of these change a risk's status, score or treatment on their own, and the two briefings leave a trace only if you save them as a record — a person reviews the output and decides.

Tips and limits

• Impact and likelihood are changed through Edit on the detail page, which opens the risk's edit form at /risks/{id}/edit; the dot scales on the detail page itself are read-only.
• The visualisations cover the whole filtered register up to a cap of 5,000 risks, highest score first. Past that, a notice above the charts says how many are shown out of the total, so a sample is never presented as the whole picture. Filter to focus them.
• Level is the governance altitude — Strategic, Tactical or Operational; Groupings holds values such as business unit or department. Manage groupings leads to the types behind that column; the values must exist before you can assign them.
• Deleting a risk (Managers and above) asks for confirmation. It is a soft delete: the risk leaves the register, the row is kept for the audit trail, and the policies, evidence and controls it was linked to are untouched.

Where this connects

Risks are treated using Policies and proven with Evidence, linked through controls in Compliance frameworks. The sources behind a risk live in Threat actors, accepted risks in the Exceptions register, follow-up work in Action items, and supply-chain risk in Vendors. When a risk materialises, record it in Incidents — the incident response scenario follows one from register to report.