Describe the exposure, select the right scale and assign an accountable owner.
Product location: /rms/risks/new
Open Risk Register and select Identify and Assess Risk. The page heading is Log New Risk. Choose the methodology and domain before scoring. Changing methodology reloads its factor fields; the domain becomes fixed when the risk is created.
The form has seven steps. Use Next after completing the required fields in each step and Back to review an earlier answer. A step's completion indicator does not mean that the risk has been saved.
Step | What to enter |
|---|---|
Identification | A specific title, the asset at risk, the threat, the vulnerability and an explanation of the consequences. |
Context & Classification | The scope and boundaries, root causes, categories and affected objectives. |
Inherent Risk Assessment | Factor scores for exposure before controls, using the selected methodology's descriptions. |
Treatment | The proposed response and concrete actions. Medium or higher inherent risk requires a proposal. |
Residual Risk Assessment | Factor scores justified by controls already in place; acceptance documentation where required. |
Monitoring & Review | The next review date and review frequency in days. |
Additional Details | The accountable owner, an optional parent risk and supporting notes. |
A title must contain 3–200 characters. Asset, threat and vulnerability are required and each allows up to 500 characters. Use the description for the fuller explanation rather than repeating the title.
The example concerns cold-chain temperature records exposed to a gateway outage because there is no failover gateway. This separates the thing of value, the event and the weakness so treatment can address the actual cause.
Product location: /rms/risks/new
Score the inherent exposure using the factor descriptions beside the selectors. The example Likelihood × Impact methodology gives likelihood 3 and impact 3 a score of 9, classified as Medium. Other methodologies can use different factors, calculations and thresholds; do not transfer this example's numbers without checking your configuration.
For Medium or higher inherent risk, enter the chosen response and actions in Treatment proposal. For example: reduce the risk by adding a failover gateway and verifying alarm continuity before the quarterly review. A proposal records intended work; it is not evidence that the control has been implemented.
Assess the residual position using controls that operate today. In the example, an independent offline logger and daily checks justify likelihood 1 and impact 3. The planned failover gateway is not included in that assessment. Residual scores at Medium or above require acceptance documentation. Record the decision and rationale rather than using a name alone as proof of acceptance.
Controls already in place (scoring note) helps suggest a residual score but is not saved with the risk. After saving, link the actual control records so their evidence, effectiveness and coverage can be reviewed. Residual factor fields are optional when creating the risk; an empty score is not a zero score.
Product location: /rms/risks/new
Choose one risk owner, a next review date and review frequency. The frequency accepts 1–365 days. Link a parent risk when this exposure is part of a broader one. Your organisation's own fields appear under Custom fields below the form steps; complete them before saving. See custom fields. Complete the final step and select Save Risk.
To stop part-way, choose Save Draft. The risk is saved with status Draft and opens so you can complete it later; it appears in the register like other drafts. A draft needs a methodology, a domain and a title. The treatment-proposal requirement applies when you save the completed risk, not the draft, and completing a draft does not create a second risk. Saving a draft while you edit an existing risk updates it and keeps its current status.
Wait for the success message and open the register. Inspect the created number, title, inherent and residual scores, status and review due date. Reopen the risk to check its treatment proposal and owner. The illustrated record is Active, with scores 9 and 3 and a review date of 12 December 2026; its note explicitly leaves owner assignment and control linking as follow-up work.
A missing methodology or domain needs configuration in RMS Settings. A saved record still needs its accountable owner, control evidence and the intended review before it can support a risk-management decision.
