Use This Doc For
/compliance/incidents/compliance/incidents/[id]/compliance/risks/compliance/risks/[id]
Purpose
Risk assessments describe a plausible hazard, its likelihood and severity, the inherent risk, and the residual risk after mitigation. Incident records capture what actually occurred. Linking both to controls and corrective actions keeps response work connected to the broader compliance record.
Assess A Risk
- Describe the hazard and scope precisely.
- Record likelihood, severity, and inherent risk before relying on controls.
- Link the controls that mitigate the risk and add mitigation notes where needed.
- Record residual risk only after considering how those controls operate.
- Assign the assessor and next review date.
The platform displays linked incidents on the risk detail. A risk with no incidents is not automatically low risk, and an incident does not by itself prove the linked control failed.
Risk assessment List, Grid, and Board views all begin with active assessments. In Grid or Board, choose All assessments beside the view controls to inspect inactive history. The scope is retained in the URL.
Respond To An Incident
- Address safety, containment, service continuity, and required escalation through the organization’s incident procedures first.
- Create the incident with occurrence and detection times, severity, category, description, reporter, and related risk where known.
- If it may be regulator-notifiable, mark that fact and record the notification deadline. When an employee context and deadline are available, the platform creates a compliance calendar event.
- Track investigation and root cause separately from immediate containment.
- Create corrective actions for longer-term remediation, with owners and due dates.
- Record notification time only after the external notification has actually occurred.
Decisions And Consequences
- The regulatory notifiable flag and deadline create visibility; they do not decide whether notification is legally required and do not send a notice.
- Moving an incident from open or investigating to remediated or closed changes dashboard counts. Do so only when the response record supports it.
- Linking a control to a risk asserts a mitigation relationship. It does not prove the control’s effectiveness.
- Corrective actions remain separate so completion and independent verification can be tracked.
What To Watch
- incidents being logged without containment or next-step clarity
- risks staying abstract instead of driving concrete mitigation
- response work happening outside the compliance record
- notification deadlines mistaken for completed notifications
- residual risk copied from inherent risk without assessing controls
Recovery
If severity, category, timing, or linkage is wrong, correct the record promptly and explain the change in notes or the audit trail. If an incident was closed too early, return it to an active response state where the interface permits and assign the missing work. Never delete or hide an incident merely to improve posture; preserve the event and correct its interpretation.