Assess a risk

A risk you copy from the Risk Repository arrives in your register as Not assessed: it has no score, deadline or reviews yet. Assessing it fills these in, so the risk can be followed like any other.

A risk you add yourself with Add risk is assessed as you add it, so it never needs this step.

Before you start

Only the risk’s owner can assess it: the person who copied it into the register. Everyone else sees Awaiting and the owner’s first name in the risk’s row. Point at it to read “Only … can assess this risk”.

Assess a risk

1. Open Risk Register and select the Not assessed group.

2. Select Assess in the risk’s row, or select the row itself.

   A panel opens on the right, titled Assess and the risk’s code. The risk’s name and description are at the top, so you can check you have the right one.

3. Under How serious is it?, choose a Likelihood and an Impact.

   A box below them shows the score your choices give, for example 4.0 and Moderate risk.

4. Under What could it cost?, fill in Financial exposure and Mitigation budget if you know them.

5. Under Who is involved?, check Affected departments and Responsible people.

6. Under When?, set Mitigate by, choose how often to review in Review every, and set First review and its time in at.

7. Fill in Implications if it is empty.

8. Select Save assessment.

The fields

Field	Required	What to enter
Likelihood	Yes	How likely the risk is to happen, from 1 Very Low to 5 Very High.
Impact	Yes	How bad it would be if it happened, from 1 Very Low to 5 Very High.
Financial exposure	No	In N$: the possible loss if the risk happens. It can’t be negative.
Mitigation budget	No	In N$: the expected cost of reducing the risk. It can’t be negative.
Affected departments	Yes	The departments the risk would affect. The department whose register the risk is in is selected at first.
Responsible people	Yes	The people who follow the risk until it is mitigated. You are added at first.
Mitigate by	Yes	The date by which the risk should be dealt with. It can’t be in the past.
Review every	No	How often to review the risk. Until you set Mitigate by, a line under it says “Set the deadline first to see sensible options.” After that, the list only offers frequencies that fit before the deadline. Ad-Hoc is always offered. If you change Mitigate by and your choice no longer fits, it is cleared.
First review	Yes	The date of the first review: in the future, and on or before Mitigate by. If it is empty when you choose a Review every other than Ad-Hoc, VirgilTrack suggests a date.
at	No	The time of the first review. It is 10:30 unless you change it.
Implications	No	What happens to the organisation if the risk happens.

For what each likelihood and impact level means, see How risk scores work.

This panel can only add departments and people. To take someone off the risk later, edit the risk. See Edit a risk.

What happens next

• The panel closes and a message says “Risk assessed.”
• The risk’s status becomes In Progress. It leaves the Not assessed group and shows its score in the Active group.
• Before each review, VirgilTrack reminds the responsible people. See Risk reviews and reminders.
• VirgilTrack’s AI may suggest a line about the assessment for your weekly work report.

Next, open the risk and add the controls that will reduce it. See Add a control to a risk.

Wenk

To close the panel without saving, select Cancel, or select anywhere outside the panel.

If something goes wrong

What you see	Why	What to do
Save assessment doesn’t close the panel, and red messages appear	A required field is empty or not valid. A count such as “1 field needs attention” appears at the bottom.	Fix each field with a message, then select Save assessment again.
Review every has fewer choices than you expected	Only frequencies that fit before Mitigate by are offered.	Choose a later Mitigate by date first.
“Only the person who recorded this risk can assess it.”	You aren’t the risk’s owner.	Ask the owner to assess it. Their name is in the Owner column.
“This risk has already been assessed.” or “Someone already assessed this risk.”	The risk was assessed while you had it open.	Close the panel. The register now shows the risk with its score.
“This risk no longer exists, or you don’t have access to it.”	The risk was removed, or it belongs to another organisation.	Close the panel and check the register.
“This risk no longer exists.”	The risk was removed while the panel was open.	Close the panel and check the register.
“Couldn’t save. Nothing was changed. Please try again.”	Saving failed.	Select Save assessment again.

The messages under the fields are the same as when you add a risk, for example “Choose how likely it is.”, “Pick at least one department.”, “Set a deadline.” and “The review must be in the future.” Under First review, an empty date shows “Set the first review date.”

Related

• The risk repository
• How risk scores work
• The risk register