Risk engagements
Risk Management → Risk Engagements
An engagement is a scoped exercise to assess a set of risks — an annual review, a project assessment, a regulator-driven exercise.
1. Create and scope
Create the engagement, then Scope Risks to pull risks in from the register. Optionally scope assets so the report shows what was in view.
Creating an engagement needs a manager or above, and the creator becomes its owner. The owner or a lead assessor staffs the team and moves the engagement through its working statuses — Start Scoping, Begin Assessment, Send for Review — without waiting for an administrator. Cancelling an engagement and closing it remain administrator actions.
2. Assess each risk
For each scoped risk, record assessed likelihood and impact, the residual after controls, and a risk response (mitigate, transfer, avoid, accept, no action).
When a risk is marked assessed, the register shows the engagement's latest scores straight away, so the register reflects the work in progress. Closing the engagement is what records the reviewed result: it sets each risk's next review date and applies the risk response (see Close).
Sign-off
Each assessed risk goes through three signatures, in order:
- Preparer (assessor, lead assessor or owner) signs once likelihood, impact and the risk response are all recorded.
- Reviewer signs once the preparer has, and only when no review note is left open. The reviewer can instead return it to the preparer.
- Approver signs once the reviewer has, again with no open notes. The approver can return it to the reviewer, even after signing.
The reviewer must be a different person from the preparer, and the approver different from both. If your team is too small for that, the platform lets the same person sign again only with a recorded reason (at least 10 characters), shown against that sign-off in the history.
From the moment the preparer signs, the assessment and its controls are frozen: the reviewer signs exactly what the preparer signed. To change anything, the reviewer returns it to the preparer, which clears the preparer's signature and reopens the work; after the preparer signs again the chain resumes. Once a risk is reviewed the same freeze holds until an approver returns it. Review notes are raised by reviewers, approvers, lead assessors or the owner; a note is cleared by its author or one of those roles — never by the preparer whose work it is about — and every clear is in the audit trail.
3. Divergence
If someone edits a risk directly in the register after it was scoped in, the engagement flags it as diverged — the engagement is now working from a stale picture. Reload that risk or reset it before relying on the result.
4. Close
Closing writes the engagement's conclusions back to the register, checks the results against your risk appetite, and raises breach notifications where thresholds are exceeded.
- An engagement with no risks cannot be closed — cancel it instead.
- A risk counts as complete once it is reviewed (preparer and reviewer have signed). Only reviewed risks are written back.
- You can close with unreviewed risks, but you are asked for a reason (at least 10 characters). It is kept with the close, and those risks are not written back.
- Closing happens once. If two people press Close together, the second is told it is already closed.
- After closing, the engagement's sign-offs, review notes and assessments are locked as a record of what was concluded.
If the engagement has an appetite threshold, the report lists every risk above it. With no threshold set, that section shows nothing — it is not a clean bill of health, it means the question was never asked.