Create a risk

Creating a draft normally requires the Risk.CreateDraft capability. Some view-only roles intentionally do not include it.

Before you begin

Gather a clear description of the uncertain event, its possible impact, the accountable owner, relevant dates, and any supporting files. Use an existing template if your organization has one for this type of risk.

Create and save a draft

  1. Open Risk Register and select New Risk, or select Create Risk on the Dashboard.
  2. Complete the visible Discovery fields. At minimum, provide a title and description.
  3. Choose an owner, category, dates, and other available context.
  4. Add existing mitigations when known.
  5. Use Files / Links / Tags to stage attachments, related risks, and tags. Jira linking becomes available after the risk exists and reaches an eligible state.
  6. Select Save draft. You can also use Ctrl+S or Cmd+S on the Create page.
  7. Confirm that a permanent reference such as RR-1234 appears after creation.

Image needed: Create Risk page with section navigation, Save draft, Submit for Review, and Files / Links / Tags highlighted.

The exact sections depend on your workflow. Later phases can add Assessment, Compliance Frameworks, Risk Tolerance, Treatment Plan, Effectiveness Review, Residual Risk, Monitoring, Reassessment, and Closure.

Apply a template

  1. Open the Templates menu on the Create page.
  2. Select an available personal, shared, or system template.
  3. Review every populated section. A template can replace values, not merely add missing ones.
  4. Make the content specific to this risk before saving.

Eligible content can be saved as a personal template and managed from My Account.

Submit for review

  1. Review every visible section for accuracy.
  2. Save any outstanding changes.
  3. Select Submit for Review.
  4. Read and correct any prerequisite message.
  5. Confirm the risk leaves Draft.

Submission first moves the risk to Submitted. With successful automatic reviewer assignment, it can continue to Under Review. Otherwise, an authorized manager must assign an analyst.

Required information changes over time

Fields that were optional during intake may become required before a later action. Common examples include:

  • likelihood and impact before validation;
  • tolerance justification and approver before an accept-within-tolerance decision;
  • a treatment plan before approval;
  • completion date before treatment is completed;
  • effectiveness notes and residual scores before monitoring.

RiskVault names missing prerequisites when an action cannot continue. Save the relevant section after correcting them.