Understand exposure, agree the response and keep ownership visible through independent verification.
The target is an objective, not an achieved result.
A former employee could retain payroll access because leaver notifications and account removal happen separately. Explain the cause, possible event and business consequence. The next reviewer needs that context alongside the score.
Record the cause, event, consequence, affected service and accountable unit.
Record the cause, event, consequence, affected service and accountable unit. Explain existing controls and the assessment rationale. Omar’s payroll example makes the concern understandable without granting access to unrelated records.
Separate inherent, current and target exposure.
Separate inherent, current and target exposure. Each saved assessment retains its method version, rationale, next review and any approved evidence references. A changed method does not rewrite previous assessments. The target describes an objective, not an achieved improvement.
Save and submit the assessment before acceptance review.
Save and submit the assessment before acceptance review. Submission locks it against editing until returned or withdrawn. In the example, Alex records time-limited acceptance above appetite as an independent tenant admin. The exposure remains visible and acceptance cannot extend beyond the next review.
Plan actions with outcomes, owners, dates and dependencies.
Plan actions with outcomes, owners, dates and dependencies. A separate payroll package shows Maya’s account-removal action verified while Sam’s supplier-feed confirmation remains planned. It is not linked to the captured risk. Shared subject matter does not create a stored relationship.
The action owner submits current approved proof.
The action owner submits current approved proof. An independent reviewer checks that same evidence and records verification or returns the work. Changed proof requires fresh review. Every package action must be verified before the issue enters its own resolution and independent closure process.
A verified action does not automatically lower the risk score.
A verified action does not automatically lower the risk score. Review remaining exposure, changed evidence, incident lessons and expiring acceptance. Reopen an accepted risk before reassessing it, retaining the earlier decision and the reason for the new assessment.
Choose a step to see the real record, the responsible person and the reason for the next action.
Omar explains how delayed account removal could leave a former employee with payroll access. The retained assessment records cause, event, consequence and rationale. Current exposure is 12; the target is 3.
A reviewer can understand the assessment and distinguish today’s exposure from the improvement the team aims to achieve.
Target 3 is an objective, not an achieved result.
Fictional workspace · English interface
Omar explains how delayed account removal could leave a former employee with payroll access. The retained assessment records cause, event, consequence and rationale. Current exposure is 12; the target is 3.
A reviewer can understand the assessment and distinguish today’s exposure from the improvement the team aims to achieve.
Target 3 is an objective, not an achieved result.
Open full product screen ↗The treatment record names Omar, the target date and the plan to reconcile leavers with payroll access. An authorised reviewer records time-limited acceptance while that work progresses. The remaining exposure stays visible.
An agreed response gives the next review a clear owner, deadline and decision to revisit.
This risk has no stored ticket or control links in the example.
Open full product screen ↗In the separate payroll action package, Maya submits proof of account removal and Alex independently verifies it. A second action, confirming the supplier’s daily leaver feed, remains planned. The package is unfinished.
Owners and reviewers can distinguish submitted work, verified results and the actions still requiring attention.
Separate remediation example: one verified action, one planned. Completing work does not automatically rescore the risk.
Open full product screen ↗The retained example uses method v1 and an appetite threshold of 6/25. These values are distinct assessment positions, not a before-and-after improvement chart. Current exposure is above appetite, so acceptance requires an independent tenant admin.
The inherent position recorded in this assessment.
The recorded remaining exposure; it has not fallen to the target.
The intended position after effective treatment, not a verified result.
Indicators, incidents and findings help the team decide what needs attention. Each keeps its own source and review history.
Retain thresholds, measurement sources and freshness. A missed target opens one linked issue or updates the existing response. Ordinary risk signals do not change control conclusions; explicitly configured control tests can. Closing a response needs a fresh on-target reading, closed corrective work and independent review.
Separate occurrence, detection and reporting. Distinguish near misses from realised events, and confirmed SAR losses from recoveries and estimates. Request reassessment of a linked risk when lessons warrant it. Operational closure with corrective work still open requires a current independent handoff.
Follow permitted source links into corrective work. Supplier findings retain their own review and disposition workflow. Patch outcomes use their declared asset-and-update scope; a closed finding or completed action does not prove coverage of the whole estate.
Owners work within granted scope. The risk owner, assessor and submitter cannot approve their own acceptance. Action owners cannot verify their own work. Authorised independent reviewers retain the decision; auditors inspect permitted records and executives use their permitted read-only view.
An independent active GRC lead or tenant admin can accept within appetite. Above-appetite acceptance requires an independent tenant admin. The current assessment, method, evidence and expiry must meet the tenant’s published rules.
No. Verified work supports a new assessment; it does not change the score or close the source risk automatically. The captured payroll risk and action package are separate examples.
Request a revised date with a reason. The original deadline stays in force until an independent reviewer approves the change. Exceptions retain their rationale and expiry; they do not represent completed work.
No. It can create follow-up or request reassessment, but the owner still explains the exposure. An incident-driven reassessment request is retained with the risk and addressed through a new saved assessment.
Follow the assessment, the people responsible and the proof needed for the next decision.