Risk Details

The risk detail panel is the full risk workspace, opened from the top-level Risks tab, an assessment's risk register, or an incident. It is an ISO 31000-aligned tool for identifying, scoring, treating, and monitoring privacy risks. The panel splits into visually separated section cards — Risk details and Risk management — each with its own pencil that flips just that card into edit mode with its own Save and Discard. There is no panel-wide edit toggle; you edit one card at a time, and every edit session re-seeds from the last saved values, so Discard is always safe.

Status

The header carries the risk's status dropdown. You move a risk between the open states directly here:

Scoring a Risk

The Risk details card captures the risk's identity (title, description, category, source) and two likelihood × impact pairs:

1. Inherent — likelihood and impact before controls.
2. Record your controls / mitigation measures in between.
3. Residual — likelihood and impact after controls.

AccessPoint derives the inherent and residual rating bands (Low / Medium / High / Critical) from those pairs and shows them as coloured badges, plus a residual trend arrow — up in red, down in green — versus the last score. In a privacy assessment you can also set the Harm to individuals level (No risk / Minimal / Possible harm / Real risk of significant harm). On an incident the harm band is instead server-derived from the two breach axes and shown read-only.

Managing the Risk

The Risk management card holds:

• The treatment strategy — Avoid / Reduce / Transfer / Accept
• A treatment rationale
• The risk owner
• The target risk level and target date
• A review cadence — monthly, quarterly, semi-annual, annual, or ad-hoc — with the next review date
• Triggers, a contingency plan, and dependencies on sibling risks

Choosing the Accept strategy reveals an inline acceptance sub-form: approver, expiry date, conditions, and justification. If the risk is over your risk appetite, a justification and an expiry are mandatory before it will save. This enforces time-boxed, governed acceptance rather than a silent sign-off.

The risk can carry assignable treatment actions — see Risk Treatment Tasks — and measurable indicators defined from its Monitoring tab, see Risk Indicators.

Risks of a System

A risk that belongs to a system rather than to one program — shared administrator accounts on the recreation software, an unpatched file server — is recorded once, on the system: create an organizational risk on the Risks tab and choose the System it belongs to (the list is the systems register; a card shows the system in place of a case number). A system with risks recorded against it cannot be deleted from the register — decommission it instead (see Privacy Systems).

Every assessment of a subject that runs on the system sees those risks. On an assessment's Risks tab, From the systems this subject runs on lists each system in use, the state of its security assessment (in effect since a date, due for update, in progress, none yet — and how many of its risks are over appetite) and the risks recorded on it. Nothing is copied in by itself: Take into this assessment adds the risk to the assessment as its own risk, linked back to the system's; rate it for this program as you would any risk. When your rating differs from the system's, the list flags it (Differs from the system's rating).

Two events flag the assessments of the subjects that run on a system for update: that security assessment taking effect while any of its risks is over appetite (an authorization with conditions), and the system being decommissioned. The assessment shows Reassessment recommended with the reason; re-approving it clears the flag.

Closure, Activity, and Discussion

• The Closure tab is the only route to Closed: add a close note and Close, or later Reopen with a reason. Assessment risks can also be recorded as an incident here.
• The Activity tab is a read-only audit change-feed of lifecycle, treatment, and indicator events.
• The Discussion button opens a layered comment thread anchored to the risk, with an unread count.
• The … menu comes first in the header's action row, before the assistant and Discussion, as on the case panels: Add reminder, Place preservation hold… (when your organization uses case archiving — see Preservation Holds) and, for a standalone risk that is still Open, Delete risk. A follow-ups card lists the risk's open and upcoming follow-ups — see Case Follow-ups.
• A link to a risk (from a follow-up notice or My Day) opens it on the Risks tab.

Risk Portfolio Analysis

When AI Assist is enabled, the Risks dashboard offers a risk portfolio analysis — a What should I know? card that narrates your register in plain language: where exposure concentrates, which reviews are overdue, treatment target dates that have slipped, and acceptances that have expired. It reads across the risks you can see and summarizes the pattern so it is easy to spot at a glance.

The analysis is a read-only narration of the register. It surfaces only what is already recorded and never changes a risk — every score, treatment strategy, and acceptance stays exactly as your team set it, and a person still decides what to act on. AI Assist runs on an Azure OpenAI resource in your organization's own Azure subscription and region: risk data never leaves your tenant, Microsoft does not train its models on it, and prompts and responses are not stored (only usage metadata is kept). The card appears only when your administrator has deployed AI Assist and enabled the feature under Settings → Features.