Adding Risks

While PartnerAlly automatically identifies some risks through document analysis and gap detection, you'll often need to add risks manually. This guide covers how to create comprehensive risk entries.

When to Add Risks Manually

Add risks when:

• Completing risk assessments
• Reviewing vendor relationships
• Identifying operational risks
• Recording audit findings
• Documenting security concerns
• Tracking business risks

Creating a Risk

Basic Process

Risk Form Fields

Required Fields

Optional Fields

Assessing Likelihood

Use this scale to assess how probable the risk is:

Assessing Impact

Use this scale to assess potential business impact:

Severity Assignment

Severity is typically calculated from likelihood × impact:

Or assign severity directly based on judgment.

Risk Categories

Security

Examples:
- Unauthorized access to systems
- Data breach through vulnerability
- Malware infection
- Insider threat
- Social engineering attack

Compliance

Examples:
- Failure to meet SOC 2 requirements
- GDPR violation
- Audit finding not remediated
- Regulatory penalty risk
- Certification lapse

Operational

Examples:
- Key system downtime
- Process failure
- Staff capacity shortage
- Critical skill dependency
- Communication breakdown

Vendor/Third-Party

Examples:
- Vendor data breach
- Service availability failure
- Contract non-compliance
- Concentration risk
- Vendor financial instability

Financial

Examples:
- Revenue loss
- Unexpected costs
- Currency exposure
- Credit risk
- Fraud

Writing Good Risk Descriptions

Risk Title

Good titles are:

• Specific and clear
• Action or outcome focused
• Scannable

Risk Description

Include:

1. What could happen
2. How it could happen
3. What the impact would be
4. Any context or history

Example:

Our primary cloud provider could experience an extended outage (>4 hours), causing our SaaS platform to become unavailable to customers. This would result in SLA violations, potential customer churn, and reputational damage. We have had 2 minor outages in the past year.

Linking to Other Items

Linking to Gaps

Connect risks to related compliance gaps:

1. In the risk form, find "Related Gaps"
2. Search for and select relevant gaps
3. The risk and gaps are linked

Why link:

• Closing gaps may mitigate risks
• Shows relationship between compliance and risk
• Helps prioritize gap remediation

Linking to Controls

Connect risks to controls that mitigate them:

1. In the risk form, find "Related Controls"
2. Search for and select controls
3. Control status affects risk assessment

Creating Risks from Gaps

You can create a risk directly from a gap:

1. Open a compliance gap
2. Click "Create Risk"
3. Risk form pre-populates with gap info
4. Adjust and complete the risk details
5. Risk is automatically linked to the gap

Bulk Risk Import

Import multiple risks at once:

Risk from Assessment

When completing a risk assessment:

1. Document findings in your assessment tool
2. Export or manually enter significant risks
3. Link assessment document as evidence
4. Track remediation via workflows

Common Mistakes to Avoid

After Adding a Risk

Once a risk is created:

1. Assign owner if not already done
2. Link to gaps that relate to the risk
3. Create workflow if mitigation is needed
4. Set reminders for periodic review
5. Communicate to stakeholders if significant

Next Steps

• Risk Details - View and manage risks
• Priority Queue - See where your risk ranks
• Workflows - Create remediation plans