Risk management

Risk management keeps a register of the risks your company faces, how serious each one is, and how you’re responding to it. Once every risk is assessed, you take a snapshot, which is a dated, permanent record of your risk assessment. Your auditor sees your latest snapshot, and Oneleet attaches it to your compliance program as evidence.

Find it under Compliance > Risk management. Admins can add, assess, archive, and delete risks and take snapshots, and so can anyone whose custom role grants risk permissions. Members and Auditors can view the register and snapshots.

Your register and snapshots

Your register, Your active risks, is the list you keep current all year. You can add, assess, and archive risks in it at any time, and opening Compliance > Risk management always takes you straight to it.

Taking a snapshot records the register as it stands, with a name and the date you took it. After that, the ratings, each response and its answer, and the linked controls in the snapshot can’t be changed. Your register stays open, and every risk that isn’t archived carries forward into it with its answers, owner, and linked controls, ready for your next assessment. Once you’ve taken your first snapshot, a Snapshot history button in the register’s header lists all of them.

Set up your register

On the Risk management page, click Get started to open your register.

Add risks

To add risks from the library:

1. Click Risk library in the page header, or Add from library on an empty register.

2. Browse by category or search, and select the risks that apply to your company.

3. Click Add risks (it reads Add risk when you’ve selected one).

Pick the risks that apply to your company and focus on the biggest ones, rather than adding the whole library. If your workspace has a SOC 2 framework, include at least one risk in the Fraud category (see What this means for your audit).

To add a risk of your own, click Add risk (or Add first risk on an empty register), enter a title, an optional description, and a category, and click Add risk.

If we’ve added AI-suggested risks to your register, they arrive with answers suggested from your company profile, and you review each one (see Review AI-suggested risks).

Choose a matrix size

By default, your first register uses a 3×3 matrix, with impact levels Minor, Moderate, and Major and likelihood levels Unlikely, Likely, and Almost certain. A 5×5 matrix adds Negligible and Devastating for impact, and Remote and Possible for likelihood.

To switch to 5×5:

1. Add at least one risk. The menu that holds the setting appears only once the register has a risk.

2. Click the three-dot button at the far right of the page header, then click Edit.

3. Choose 5×5 under Matrix size and click Save.

Pick the size before you start assessing. You can’t switch from 5×5 back to 3×3 while any risk on the register, archived risks included, uses Negligible, Devastating, Remote, or Possible, so you’d have to change those answers or delete those risks first. Each snapshot keeps the matrix size it was taken with, and the register that opens after it uses the same size.

Assess each risk

On the register, click Start review or Continue review to walk through your unassessed risks one by one. To open a specific risk, click its name.

For each risk:

1. Under Risk details, answer Who’s responsible for this risk? by choosing an owner.

2. Under Inherent risk, choose the impact if the risk occurs and how likely it is before you do anything to reduce it.

3. Under Risk response, choose Mitigate, Transfer, Avoid, or Accept, then answer the follow-up question. For Accept, it asks Why are you accepting this risk?, and for the other three it asks how you’re mitigating, transferring, or avoiding the risk. Then link the controls that support your response (see Link controls).

4. Under Residual risk, answer Will any risk remain after implementing the response above?

5. Add any Notes you want to keep with the risk.

6. Click Continue to move to the next unassessed risk.

Oneleet combines impact and likelihood into a rating, which is Low, Medium, or High on a 3×3 matrix and ranges from Trivial to Extreme on a 5×5 matrix. Your answers save as you go.

A risk counts as assessed once it has an impact, a likelihood, a response, an answer to the response’s follow-up question, and an answer to the residual risk question, plus a remaining impact and likelihood if you answered Yes. Until then, it stays under Needs assessment on the register, even if you’ve already chosen a response. The Needed for completion bar at the bottom of the page lists what’s missing, and clicking an item jumps to it.

Continue stays disabled until the risk is complete. Click Skip to move on and come back later. When no unassessed risks remain, you return to the register. To assign an owner without opening the risk, use the Owner column on the register.

Link controls

Click Link controls to search your program’s controls and link the ones that support your response. Do this for every risk before you take a snapshot, because you can’t change a snapshot’s linked controls once it’s taken. ISO 27001 auditors ask for this traceability from each risk to its controls, and your auditor sees the linked controls in your snapshot.

Record residual risk

Residual risk is what remains after your response. Answering Yes copies your inherent impact and likelihood into Remaining impact and Remaining likelihood, so adjust them to reflect what’s left. Answering No gives the risk a residual rating of None.

Review AI-suggested risks

A risk we’ve suggested from your company profile opens on an AI-suggested assessment card instead of the full form.

Review each suggestion against what you know about your company before you click Accept. Accepting every AI-suggested risk without reviewing it is a common audit finding. To change anything, click Modify, update the answers, and click Continue. If the risk doesn’t apply to your company, click Not relevant to archive it (see Archive or delete risks).

A risk marked Partially completed by AI has only some answers filled in, and it counts as assessed once you fill in the rest.

Take a snapshot

Once every risk that isn’t archived is assessed, the register shows All your risks have been assessed. with a Take a snapshot button.

1. Click Take a snapshot.

2. Keep or change the Snapshot name. It defaults to the current month and year followed by “Risk Assessment”.

3. From your second snapshot on, review What changed since your last snapshot, which lists risks that were added, changed, archived, or removed.

4. Click Yes, take snapshot.

The snapshot opens with a Snapshot badge and shows who completed it and when. In a snapshot, you can’t add, archive, or delete risks, or change their ratings, their responses and the answers to them, or their linked controls. Make those changes in your register instead, and take a new snapshot. You can still edit a risk’s Notes in any snapshot, but only your latest snapshot’s evidence file updates to include them.

Archive or delete risks

To archive a risk that no longer applies, open its row menu and click Archive. An archived risk stays in your next snapshot, where your auditor still sees it marked as archived, but it isn’t carried forward into the register that opens after that snapshot. Archived risks are hidden on the register. To see them, check Archived in the Status filter.

Unarchiving a risk sends it back to Needs assessment, and you’ll need to assess it again before your next snapshot.

To delete a risk, open its row menu and click Delete, then Really delete? to confirm. You can’t undo a deletion.

To act on several risks at once, select their rows and use the bar that appears. It offers Archive when none of the selected risks are archived and Unarchive when all of them are. A mixed selection offers only Delete.

Start your next assessment

After a snapshot, your register already holds every carried-forward risk, and each one counts as assessed because its answers came with it. The register offers Take a snapshot right away, so open each risk from the register to review it before your next snapshot.

A carried-forward risk opens on a Previous risk assessment card that shows its last answers. If you haven’t changed the risk since your last snapshot, Unchanged since the last snapshot appears above the card. Once you change it, the risk opens on a comparison of your current answers with the previous ones in place of the card. From there:

• Continue: keeps the risk as it is.
• Modify: opens the full form so you can change the answers. Click Continue when you’re done.
• Not relevant: archives the risk immediately, without asking you to confirm, and moves to the next risk (see Archive or delete risks).

Reassess your risks when something significant changes. The Risk assessment completed in the past 12 months monitor alerts when your latest snapshot is more than 365 days old, so treat a yearly snapshot as the minimum.

Export the register

Click Export to download risks.csv. The file contains only the rows that match your current search and filters, and archived risks only when Archived is checked in the Status filter.

What this means for your audit

For every audit, whatever its dates, your auditor sees your latest snapshot and not your open register. They see each risk’s ratings, response, notes, and linked controls. Take a new snapshot after any changes you want your auditor to see.

If your workspace has the Risk assessments performed control, Oneleet attaches a “Risk register” CSV named after the snapshot to it as evidence within about an hour of taking a snapshot. Files from earlier snapshots stay attached. The file includes each risk’s description, response details, owner, ratings, notes, and linked controls.

Two monitors check the Risk assessments performed control:

• Risk assessment completed in the past 12 months: goes by the date you took your latest snapshot, not the snapshot’s name.
• Fraud risk identified and assessed: applies only to workspaces with a SOC 2 framework. It reads your open register, or your latest completed risk assessment if you don’t have an open register. It passes when it finds an assessed risk in the Fraud category. Archived fraud risks don’t count. Because carried-forward risks stay assessed, a fraud risk keeps counting after you take a snapshot.

A Passing control means every check that applies is passing, our team has approved the control’s implementation, and no evidence requests are pending. Your auditor reviews the control and your risk assessment separately during your audit.

For ISO 27001, you need documented risk acceptance criteria, and risk owners must approve the residual risk (clauses 6.1.2 and 6.1.3). Both are common audit findings, and Oneleet doesn’t record risk owners’ approval of residual risk.

Put your acceptance criteria in your Risk Management policy. Oneleet’s “Risk Management Policy - Comprehensive” template has a “Residual Risk and Acceptance Criteria” section in its appendix that describes a 3×3 model, so adapt the appendix if your register uses a 5×5 matrix.

Limits and edge cases

The risk library dims a risk when a risk with the same title is anywhere on your register, archived risks included. So you can’t add a library risk again after archiving it, but you can after renaming your copy.

The Residual risk matrix and Risk distribution cards on the register count archived risks along with active ones.

If your workspace’s last risk assessment was completed before snapshots existed, the Risk management page shows that assessment with a Track risks button. Click it to open a register with that assessment’s risks carried forward. Until you do, the Fraud risk identified and assessed monitor checks the risks in that completed assessment.