Risks Dashboard

The Risks Dashboard is the standalone view of your ISO 31000-aligned privacy risk register — the home screen for privacy officers and anyone holding risk permissions. It opens on the Risks tab.

The Standalone Risk Register

Risks are not created only from here — an assessment or an incident can raise a risk on the shared register, and a risk can also stand entirely on its own. The Risks dashboard is where all of them meet: one register regardless of where a risk originated. Each row shows the risk's inherent and residual rating bands (Low / Medium / High / Critical), whether it sits over your risk appetite, and its treatment status — Open, Treating, Monitoring, Accepted, or Closed — so posture across the whole register reads at a glance.

Stat cards across the top summarize the same signals as one-click filters — open risks, risks over appetite, overdue treatment targets and stale reviews, and expired acceptances — using the same click-to-filter, click-again-to-clear pattern as the Requests Dashboard's summary cards.

The Risks Tab

The Risks tab is the whole portfolio on one page: risks raised on assessments, on incidents (for people who may see incident risks), on systems, and standalone organizational risks. On the left are the overall risk level with the total count and the likelihood × impact heat map; on the right, the risk list.

• Summary cards — Critical, High, Medium and Low (the residual rating, or the inherent one where the residual is not scored yet), Needs attention (over appetite, a breached key risk indicator, or an overdue review), Needs review (every treatment finished but the residual rating still above target) and Closed (closed risks are hidden until you select this card). Select a card to show only those risks; select it again to clear it. Hover a card for what it counts.
• Source chips — one chip per source with its count: Privacy assessments, Security assessments, Audits, Incidents (only for people who may see incident risks), Systems and Organizational. Each count tells you how many risks the chip would show with every other filter applied. Select a chip to show only that source; select it again to show every source.
• Heat map — the likelihood × impact matrix is counted over every risk that matches the filters, not just the ones loaded on the page. Select a cell to show only its risks (select it again, or Show every cell, to clear it). Risks with no likelihood and impact yet are counted under the map. With the keyboard, Tab moves into the map, the arrow keys move between cells, and Enter or Space selects a cell.
• Toolbar — New risk (with the manage risks permission), the view tabs, a search box, the filter button, Sort by (needs attention first, title, assessment number or next review date) and View options. The search looks across every risk in the register: the risk title, its assessment or incident number and title, its system, owner and category.
• Loading more — the list shows 100 risks at a time. When there are more, a line says Showing 100 of N risks and Load more risks at the end of the list adds the next 100. The counts on the cards, chips and heat map always cover the whole filtered register.

Quick Filters

The filter button opens a panel of compact filters: Category, Risk owner (you), Status (by default everything except Closed), Treatment strategy (or No strategy yet), Overdue treatment tasks, Review due (overdue, in the next 30 or 90 days, or no review date), Harm to individuals, System or vendor, Program or activity and Assessment type.

A system brings in its own risks and the risks of the programs that run on it; a vendor brings in the risks of its systems and of the programs it processes for; a program brings in its assessments' and incidents' risks and the risks of the systems it runs on. Every filter narrows the list, the cards, the chips and the heat map together, and never shows a risk you could not already see. The filter button turns solid and names the filters in force; Clear filters in the panel clears the panel, and Clear filters on an empty list clears everything but your sort.

Saved Views

Like the case registers, the Risks tab has saved views: All Risks is the shared default, and View options → New view saves what you are looking at (the filters, the chips, the cards, the heat-map cell and the sort) as your own view in the tab bar, where you can edit or delete it. Administrators publish shared views in Settings → Dashboard views → Risk. The tab also remembers, in your browser, the view and filters you left it with.

With the view reports permission, View options → Open in Risk register report opens the Risk Register Report showing only the risks that match the tab's filters. The report says it is filtered and offers Show the whole register.

Risks of a System

A risk that belongs to a system rather than to one program is recorded once, on the system: create an organizational risk and choose the System it belongs to. See Risk Details and Privacy Systems.

Risk Portfolio Analysis

When AI Assist is enabled, a "What should I know?" card sits on the dashboard, available on demand. Click it and it narrates the register in plain language: where exposure concentrates, which reviews are overdue, which treatment target dates have slipped, and which acceptances have expired. It is a read-only narration — it surfaces only what is already recorded and never changes a risk; every score, treatment strategy, and acceptance stays exactly as your team set it. See Risk Details for the full privacy and deployment notes: AI Assist runs on an Azure OpenAI resource in your own Azure subscription and region, prompts and responses are not stored, and the card appears only once an administrator has deployed AI Assist and enabled it under Settings → Features.

Shared Dashboard Mechanics

Search and the summary cards work exactly as they do on the Requests dashboard — see Requests Dashboard for the mechanics and Dashboard Views for saving, sharing, and switching between filtered slices of the register.

Next Steps

• Click any row to open the full Risk Details panel — status, inherent/residual scoring, and governed treatment and acceptance.
• Define measurable Risk Indicators (KRIs) from a risk's Monitoring tab to watch drift between reviews.
• Run the Risk Register Report for the reportable, exportable view of the same posture.