Connected Enterprise Risk

OrviQ's Risk Management domain (/risks) provides a structured framework for identifying, quantifying, and mitigating organizational risks.

Risk Identity & Scoring

Every risk record captures:

Business Reference: E.g., RSK-2026-0045.
Title & Description: Detailed event description, potential root causes, and consequences.
Inherent Risk: The unmitigated risk severity and likelihood based on organizational impact criteria.
Mitigating Controls: Internal controls linked to reduce likelihood or impact.
Residual Risk: The derived risk level after taking into account the design and effectiveness of mitigating controls.
Treatment Strategy: Mitigate, Avoid, Transfer, or Accept.

[Deficiency / Gap] -> [Finding (FND)] -> [Promote to Risk (RSK)] -> [Assign Action Plan (ACT)] -> [Residual Reduction]

When an audit, assessment, or automated check identifies a gap, a Finding is logged.
Significant findings are evaluated and promoted to the active Risk Register.
Remediation tasks are assigned via Action Plans.
If a risk cannot be remediated immediately within risk appetite, a formal Governed Exception is requested.