> ## Documentation Index
> Fetch the complete documentation index at: https://help.dsalta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Risk Register

> Identify, assess, and track risks across your organization with a centralized risk register.

The Risk Register is where you document, assess, and monitor all identified risks to your organization. Compliance frameworks require you to maintain an active risk management process — this module provides the structure and audit trail.

The sidebar item is called **Risk**; the page itself is titled **Risk Register**, and switching to its second tab retitles it **Risk Library**.

## What the risk register is for

Every organization faces risks — data breaches, service outages, vendor failures, regulatory changes. Compliance frameworks like SOC 2 (CC3.1–CC3.4), ISO 27001 (A.8), and HIPAA require you to formally identify these risks, assess their likelihood and impact, decide how to handle them, and track them over time.

The Risk Register centralizes this process so your team can manage risks collaboratively and auditors can see that risk management is active and ongoing.

## Viewing your risks

The risk register shows all identified risks with:

| Column            | Description                                                  |
| ----------------- | ------------------------------------------------------------ |
| **Risk Scenario** | Name of the risk, with its description underneath            |
| **Inherent Risk** | Inherent risk score, shown as a color-coded number           |
| **Residual Risk** | Residual risk score, shown as a color-coded number           |
| **Treatment**     | Mitigate, Transfer, Avoid, or Accept                         |
| **Owner**         | Who is responsible for managing this risk, or **Unassigned** |
| **Tasks**         | How many controls are linked to the risk                     |
| **Status**        | **Approved** or **Not Approved**                             |
| **Created**       | When the risk was added                                      |
| **Due Date**      | Review due date. Overdue dates are highlighted in red        |

Click any risk to open its detail panel, which has **Risk Score**, **Controls**, and **Treatment** tabs, plus an **Owner** row you can assign from.

## Adding a new risk

1. Navigate to **Data Library → Risk** in the sidebar.
2. Click **New Register**. A **Risk Scenario** sheet opens.
3. Fill in **Risk Scenario Name** and **Description** — be specific about what could go wrong and what would be affected.
4. Under **Risk Scenario Details**, enter an **Estimated Cost** in USD.
5. On the **Risk Score** tab, score likelihood and impact under both **Inherent Risk Score** and **Residual Risk Score**.
6. On the **Treatment Plan** tab, pick one option under **Risk Treatment Options**:
   * **Mitigate** — "Identify controls to put in place or tasks to be done that will reduce the risk score."
   * **Transfer** — "Move risk outside of your organization's set of responsibilities."
   * **Avoid** — "Stop doing the activity which is causing the risk to your organization and its assets."
   * **Accept** — "Decide to live with the risk and take no further actions."
7. Click **Save**. **Close** discards the sheet.

The owner is not set here — assign one from the risk's detail panel after it is created.

## Risk scoring

Likelihood and impact are each scored from 1 to 5 on a segmented rating control, labeled:

* **1 Very low impact**
* **2 Low impact**
* **3 Medium impact**
* **4 High impact**
* **5 Very high impact**

You score them twice — once under **Inherent Risk Score** and once under **Residual Risk Score**. The resulting scores are what the register's **Inherent Risk** and **Residual Risk** columns display.

## Risk Library

The second tab, **Risk Library**, is a pre-built catalog of common risks. It lists each one with **Risk Scenario**, **Category**, and a **Status** of **Active** or **Inactive**.

Click the **+** button on an inactive row to add that risk to your register. DSALTA creates the risk record, sets its treatment plan to **Mitigate**, and links the controls the library entry maps to.

<Warning>
  Clicking the **×** button on an active row does not just hide it — it deletes the matching risk record from your register, along with any scoring or treatment work you have done on it. There is no undo.
</Warning>

Category exists on library entries only. Once a risk is in your register it has no category field, which is why the register has no Category column.

## Reviewing risks

Risks should be reviewed regularly — quarterly at minimum, or whenever your environment changes significantly. During a review:

1. Assess whether the likelihood or impact has changed, and re-score the risk if so.
2. Verify that treatment plans are being executed and that the linked controls are passing.
3. Delete risks that are no longer relevant.
4. Add new risks identified since the last review.

A risk carries a single status — **Approved** or **Not Approved** — so use the **Due Date** column to schedule the next review rather than looking for a "closed" state.

## Related pages

* [Controls](/guides/compliance/controls)
* [Inventory](/guides/data-library/inventory)
* [Vulnerabilities](/guides/data-library/vulnerabilities)