Managing risks

A risk is something that could go wrong and stop your organisation from doing its work or reaching its goals. For example, “Collections fall short of the budget” or “Refuse trucks out of service”. In VirgilTrack, each department records its risks, scores how serious they are, and plans and tracks the work that reduces them.

Who uses this area

• Employees and managers do the day-to-day risk work. They see Risk Register, Kanban Board and Risk Repository in the menu on the left.
• The CEO doesn’t see these three menu items. The CEO follows risks across the whole organisation on the CEO Dashboard and on each department’s page. See Dashboards and Departments. Links to a risk, such as a “New risk created” notification, open the risk’s own page.

Each department has its own register. You see the risks recorded by your department.

The three risk screens

Menu item	What it is for
Risk Register	The list of your department’s risks, with their scores, controls, status and next review. Add, open, mitigate and archive risks here.
Kanban Board	Your department’s New, In Progress and Mitigated risks as cards in three columns: Yet to Start, Under Control and Mitigated. Drag a card to change its status.
Risk Repository	Risks that VirgilTrack suggests for your organisation. Copy the ones that apply to you into your register.

The main ideas

Likelihood and impact. Likelihood is how likely a risk is to happen. Impact is how bad it would be if it did. Each goes from 1 (Very Low) to 5 (Very High).

Risk score. VirgilTrack turns likelihood and impact into a score out of 10 and a level: Low, Moderate, High or Critical. See How risk scores work.

Owner and responsible people. The owner is the person who recorded the risk. Responsible people follow the risk until it is mitigated, and get its review reminders.

Controls. A control is a concrete action that reduces a risk, such as “Weekly check of supplier bank details”. Each control has someone responsible and a deadline. See Risk controls.

Reviews. Every assessed risk has a next review date. On that date, the responsible people check whether the risk has changed and whether its controls are working. See Risk reviews and reminders and Review a risk.

Strategic or operational. A risk that threatens one or more objectives in your strategic plan is Strategic. Any other risk is Operational.

The life of a risk

1. Recorded. Someone adds the risk with Add risk, or copies it from the Risk Repository.
2. Assessed. Its likelihood and impact are chosen, which gives it a score. A risk you add yourself is assessed as you add it. A copied risk is Not assessed until its owner assesses it.
3. Worked on. Controls are added and carried out. The risk is reviewed on its review dates.
4. Closed. When every control is done, someone marks it as mitigated. A risk you no longer need to manage can be archived instead.

Risk statuses

Status	What it means	How a risk gets it
Not assessed	The risk has not yet been assessed for likelihood and impact.	It was copied from the Risk Repository.
New	The risk has been identified, but no actions have been taken yet.	It was added with Add risk, or moved to Yet to Start on the board.
In Progress	Actions are being taken to reduce the risk.	Its owner assessed it, or it was moved to Under Control on the board.
Mitigated	The risk has been dealt with and is under control.	Someone marked it as mitigated, or moved it to Mitigated on the board.
Archived	The risk has been put away. Nothing is deleted.	Someone archived it from the register.

Tip

Start with Risk Register in the menu. Most of your risk work begins there.

Pages in this chapter

• The risk register: the list of your department’s risks, and how to search, filter, sort and select them.
• Add a risk: record a new risk, step by step.
• The risk repository: copy suggested risks into your register, hide the ones you don’t need, or link them to a risk you already have.
• Assess a risk: give a copied risk its likelihood, impact, deadline and reviews.
• How risk scores work: how likelihood and impact make a score and a level.
• A risk’s page: everything about one risk, its controls and its discussion.
• Edit a risk: change a risk’s details, scores, dates or people.
• Mark a risk as mitigated or archive it: close a risk when the work is done.
• The Kanban board: see risks by status and move them by dragging.
• Risk controls: what controls are and how a risk’s controls are listed.
• Add a control to a risk: plan an action that reduces a risk.
• Mark a control as implemented: record that a control’s work is done.
• Comment on a control: post updates and evidence on a control.
• Risk reviews and reminders: how risk reviews and their reminders work.
• Review a risk: check a risk on its review date and record what you found.
• IPSAS readiness risks: risks that could hold back a move to IPSAS accounting, and their report.