Workflow lifecycle

RiskVault's default workflow branches according to assessment and treatment decisions. Administrators can change states, transitions, required fields, and permissions, so your organization's exact path can differ.

The journey from draft to closure

  1. Intake — the creator prepares and submits a draft.
  2. Review — an analyst assesses likelihood and impact, then validates, returns, or rejects it.
  3. Decision — a validated risk moves toward treatment or formal acceptance within tolerance.
  4. Treatment — the plan is prepared, approved, performed, and completed.
  5. Effectiveness and residual risk — the team checks whether treatment worked and scores the remaining exposure.
  6. Monitoring — the risk is observed and reassessed when needed.
  7. Closure — the outcome is documented, then the record may be archived.

Image needed: Simple horizontal workflow diagram showing Intake, Review, Decision, Treatment, Residual Risk, Monitoring, and Closure, including the accept-within-tolerance branch.

Who does what

  • Creator or owner — records and submits the risk, responds to requests, and remains accountable.
  • Reviewer or analyst — assesses and validates submitted risks.
  • Treatment approver — approves the planned response before work begins.
  • Tolerance approver — authorizes the decision to accept a risk without further treatment.

One person can hold more than one responsibility if the organization's policies allow it.

Review an assigned risk

  1. Open the item from My Tasks > To action.
  2. Read the intake information and supporting files.
  3. Enter likelihood and impact scores.
  4. Add required assessment notes.
  5. Choose the appropriate decision:
Decision Result
Request More Info Returns the risk to the owner for clarification and resubmission.
Reject Stops processing and retains the reason.
Validate — needs treatment Moves to treatment planning.
Validate — accept as-is Sends the decision to a tolerance approver.

Common phases and states

Intake and review

Draft, Submitted, Under Review, and Requires More Info. Common actions include Submit, Assign Reviewer, Request More Info, Resubmit, and Reject.

Assessment and validation

Validated, Requires Treatment, Business Assessment: Within Tolerance, and Governance Approved. The risk branches toward treatment or monitoring.

Treatment

Treatment Planning, Treatment Approved, Treatment in Progress, Treatment Completed, and On Hold. Actions can prepare, approve, start, pause, resume, and complete the plan.

Effectiveness and residual risk

Effectiveness Review documents results. Residual Risk Assessment scores what remains. Insufficient treatment can send the risk back for more work.

Monitoring and closure

Monitoring and Reassessment Scheduled support ongoing review. Closed, Archived, and Rejected preserve terminal records. Reopening is a controlled action requiring permission and a reason.

Why an action is missing or blocked

Every transition checks the current state, your dedicated claim, record-specific access, assignment when relevant, and required data. Seeing a risk does not imply permission to perform every action.

If an action fails, read its prerequisite message, complete and save the named fields, then retry.