Appearance
Risk Management
Identifying what is not as it should be, deciding what to do about it, doing it, and verifying it was done.
Pages in this area
| Page | Route | What it does |
|---|---|---|
| Risk Register | /risks | The enterprise risk register with connected assurance signals |
| KRI Register | /kris | Key risk indicators, thresholds and breaches |
| RCSA | /rcsa | Risk and control self-assessment campaigns |
| Findings | /findings | The unified findings register |
| Action Plans | /action-plans | Governed remediation |
| Exceptions | /exceptions | Time-bound, approved deviations |
Documentation for this area
| Article | What it covers |
|---|---|
| Risk & Remediation overview | The whole domain |
| Enterprise Risk Register | Statuses, treatment and the six assurance signals |
| Risk Acceptance | Treatment intent versus governed acceptance |
| Findings | Per-source vocabularies and the closure rule |
| Action Plans | Owner, approver, verifier |
| Exceptions | Why an exception never satisfies an obligation |
Two rules that govern this area
Risk stays human-governed. Assurance signals inform risk decisions; they never silently overwrite a rating, a treatment decision or an acceptance state.
Completion is not closure. Completing a remediation action does not close the finding it serves.
Permissions and entitlement
Risk register and KRIs require Risk Management. RCSA requires Control Assurance. Findings, action plans and exceptions require Compliance Core.