Risk library
Risk Management → Risk Library
The library is where risks are described. The register is where risks are owned and evaluated. Keeping the two apart is what makes the register defensible: nothing appears in it that somebody has not adopted on purpose.
Library versus register
| Risk library | Risk register | |
|---|---|---|
| What it holds | A plain risk statement: title, description, category, source | The same risk, made concrete for your organisation |
| Score | Indicative inherent likelihood × impact only | Inherent and residual, after controls |
| Owner | None | A named person accountable for it |
| Assets and processes | None | Mapped to the assets and processes it affects |
| Controls and treatments | None | The controls in place, treatments, KRIs, appetite checks |
| Status | None | identified → assessed → treating → monitored → closed |
A library entry is a template. A register risk is an instance of that template that has been taken on, assigned and assessed.
Two libraries on one page
The page shows two kinds of catalog.
Bundled catalogs ship with the platform: ISO 27005, NCA, NIST CSF 2.0, PDPL, Basel III operational risk, SAMA, CSA cloud and enterprise ERM. They are read-only reference taxonomies. Preview shows their categories and risk definitions.
Organisation Risk Library is yours. It always sits first on the page and holds every risk statement your organisation has adopted, whatever its origin. Each entry carries an Origin badge: the catalog it was adopted from, or In-house for risks you wrote yourself.
Filling your library
From a bundled catalog. Click Add to library on the catalog. Its risk definitions are copied into your organisation library with their inherent scores and category names. The button changes to In your library. Nothing is created in the register at this point.
By hand. Click Add risk and complete the form. Ref, category, title, description, source and the 1–5 likelihood and impact are required; the Arabic fields, threat source, vulnerability, existing controls, impact areas and tags are optional. The ref must be unique within your organisation, because it becomes the risk code when the entry reaches the register.
Entries in your library can be edited or deleted from the preview table (manager role or above). Both actions are local to your organisation: editing an adopted entry never changes the bundled catalog, and deleting an entry never touches a risk already in the register.
From library to register
Open the organisation library's preview and click Import on a row to instantiate that one risk in the register, or Import all to register on the card to instantiate every entry not already there. The platform:
- creates the risk category if it does not exist yet, reusing it by name if it does;
- creates the register risk with the library's inherent score and status
identified; - assigns the person importing as the initial owner, so reassign it if that is not right;
- skips any ref that already exists in the register, so importing twice is safe;
- records the origin catalog and version in the risk's tags.
From there the risk is worked in the register: confirm the owner, map the assets and processes, evaluate it in an engagement, record the residual score and treatments.
It costs nothing to hold a whole catalog in your library. What goes into the register should be the risks you can actually name an owner for, because the register is what auditors and regulators read.
Permissions
| Action | Minimum role |
|---|---|
| Browse and preview catalogs, view your library | Viewer |
| Add a catalog to the library, add / edit / delete an entry | Manager |
| Import from the library into the register | Manager |
Every add, edit, delete and import is written to the audit trail.