Overview

Every vendor has a Manage Risk tab. It is the vendor's risk register: you record a risk, score it, decide how to treat it, and close it, moving through four steps. You can also send risks to the vendor so they respond to them and upload evidence.

Prerequisites

• vendor:risk:view to open the Manage Risk tab. Without it the tab shows an access-denied screen.
• vendor:risk:add to add a risk, save any of the four steps, mark and send risks for evaluation, and delete risks. Without it the Add Risk button and the row menu are hidden.
• A SPOC email on the vendor if you want to send risks to the vendor for evaluation

Opening Manage Risk

Navigation: Sidebar → Vendors → [select a vendor] → Manage Risk

Status cards

Seven cards run across the top: All, Pending, Planning, In Progress, On Hold, Completed and Waived, each with a count. Click a card to filter the table to that status. Click it again, or click All, to clear the filter.

The risk table

Above the table you can Search, filter by Status, and page through the list (10 risks per page by default).

How severity is worked out

Adding a Risk

Navigation: Sidebar → Vendors → [vendor] → Manage Risk → Add Risk

1. Click Add Risk in the header of the table.
2. Fill in the form:

Then click Add Risk. While saving the button reads Creating.... The risk appears in the table with status Pending and source Manual, and the assignee is notified by email.

Risks also arrive without you adding them here:

• Mark as Risk on an assessment answer creates a risk with source Assessment. See How to Review Assessment Responses.
• Add Risk on a Digital Risk finding creates a risk with source DRM. See How to Monitor Digital Risk (DRM).

Working a Risk Through the Four Steps

Click a risk row to open it. A stepper shows STEP 1 to STEP 4, with an explanation beside each step.

Controls on every step:

• Save & Proceed saves the step and moves to the next one.
• Go Back to Previous Step moves back without saving.
• Back to Manage Risk Section returns to the risk table.
• View Comments opens the Comments drawer for this risk.

A risk opens on STEP 2. To change its title, description, assignee or due date, click Go Back to Previous Step to reach STEP 1.

Step 1 — Risk Initiation

Click Save & Proceed.

Step 2 — Risk Scoring & Prioritization

The risk's title and description are shown for reference. Score the risk on three fields, all required:

How the exposure is calculated: each likelihood and impact option carries a weight, and the exposure is likelihood weight × impact weight ÷ 10.

For example, Likely and High give 7 × 7 ÷ 10 = 4.9, which is Medium severity.

Click Save & Proceed.

Step 3 — Risk Management

1. In Mark Risk As, choose In Progress or On Hold.
2. Read the Risk Title and Risk Description, which are shown for reference.
3. Choose a Response Strategy (required): Avoidance, Mitigation, Transfer or Acceptance.
4. Write the Response Plan (required, up to 500 words, no leading or trailing spaces).
5. If the strategy is Mitigation, three more fields appear. Complete them as described below.
6. Click Save & Proceed.

For any strategy other than Mitigation, those three fields are hidden and any earlier mitigation values are cleared when you save.

Step 4 — Risk Closure

1. In Mark Risk As, choose Completed or Waived.
2. Choose the Residual Risk Likelihood and Residual Risk Impact — what remains after treatment. Both are required.
3. Check the Residual Risk Exposure. It is filled in from the two fields above, must be between 0 and 10, and can be overwritten.
4. Review the evidence and private documents (see the next section).
5. Click Finish & Close Risk. You are returned to the risk table.

The residual exposure replaces the risk's exposure score, so the Risk Severity shown in the table after closure reflects the residual position.

Evidence and Private Documents

Step 4 has two document tabs.

Risk evidence

The Evidence Documents table lists files evidencing the treatment — uploaded by your team here, or by the vendor when they respond to an evaluation.

Row actions: View and Delete (confirmed with Are you sure you want to delete this evidence document?).

To upload evidence:

1. In the Upload Evidence area, click to choose files or drop them in. Click again to add more.
2. Check the selected files. Remove any you do not want.
3. Click Upload evidence.

If no evidence exists yet, the tab reads No evidence detected with a reminder that mitigation evidence should be provided before the risk is closed.

Private Documents

Private documents are for internal use only. They are stored with the risk for your reference and are never shared with or visible to the vendor.

1. Open the Private Documents tab and click Upload or Link Documents.
2. Under Choose Action, pick Upload New File or Link Unlinked Documents.
3. For an upload, drop or choose the files and click Upload. For a link, choose one or more files under Select from Unlinked Documents — files already held for this vendor but not yet attached to anything — and click Link Documents.

Row actions: View Document and Delete.

File limits

Your administrator may have configured different size limits; the upload area always shows the limits that apply.

Sending Risks to the Vendor for Evaluation

You can ask the vendor to respond to selected risks.

Navigation: Sidebar → Vendors → [vendor] → Manage Risk

1. On each risk you want the vendor to see, click ⋮ → Mark Evaluation. Only risks at Pending, Planning or In Progress can be marked. Unmark Evaluation removes the mark.
2. Once at least one risk is marked, a Risk Evaluation Actions button appears in the table header. Click it.
3. Choose Send Evaluation.
4. In the Send Risk Evaluation dialog, set the Risk Evaluation Expiration Date (required) — the last day the vendor can respond.
5. Click Send.

Reset Selected, in the same menu, clears all your marks without sending anything.

What happens next:

• The vendor's SPOC receives an email with a link to the evaluation, valid until the expiration date. The vendor's additional emails, the assigned manager and the business owner are copied.
• The vendor signs in with a one-time code sent to their email, responds to each risk and can upload evidence, then submits.
• When the vendor submits, the assigned manager is notified by email. Uploaded files appear under Risk evidence with approval status Pending.
• The risk's Evaluation Date column then shows a date instead of Pending.

Things to know:

• Your marks are personal to you and are kept for 24 hours. Marks you do not send within that time are dropped.
• If the vendor already has an evaluation in progress that has not expired, the newly sent risks are added to it rather than starting a second one. A message tells you this. The existing expiration date is kept unless the new one is earlier.

Comments on a Risk

1. Open a risk and click View Comments.
2. Type in Add Comment. Comments can be up to 500 words.
3. Choose whether the comment is Internal or External. Internal comments let you @mention colleagues.
4. Click Add Comment.

You can edit or delete your own comments. An edited comment is marked (edited).

Deleting a Risk

1. On the Manage Risk table, click ⋮ on the risk's row.
2. Click Delete and confirm with Confirm Delete.

The risk is removed from the table and from the status counts. A risk raised from an assessment answer is detached from that answer when deleted.

Troubleshooting

The Manage Risk tab shows an access-denied screen → You need vendor:risk:view.

There is no Add Risk button or ⋮ menu → Both need vendor:risk:add.

The risk opened on scoring, not on its basic details → Risks open on STEP 2. Click Go Back to Previous Step to reach STEP 1.

Save & Proceed does nothing → A required field on the step is empty or invalid. Look for the message under the field, such as Risk Likelihood is required., Response Strategy is required. or Response Plan is required.

"Minimum value is 0." / "Maximum value is 10." / "Only numeric values are allowed." → Risk Exposure and Residual Risk Exposure must be numbers from 0 to 10.

"Cannot start or end with spaces." → Remove the space at the start or end of the text.

"Response Plan cannot exceed 500 words." → Shorten the text. The same limit applies to Risk Description, Mitigation Plan and Controls.

The mitigation fields never appeared → They only appear when Response Strategy is Mitigation.

Mark Evaluation is missing on a risk → Only risks at Pending, Planning or In Progress can be marked. Risks that are On Hold, Completed or Waived cannot.

The Risk Evaluation Actions button is not showing → It appears only when you have at least one risk marked. Marks lapse after 24 hours.

"Please add vendor's SPOC email to send the risks to" → The vendor has no SPOC email. Edit the vendor and add one, then send again.

"Some risks were not found or are already COMPLETED" → One of the marked risks was completed or deleted after you marked it. Click Reset Selected and mark the risks again.

"You have an ongoing assessment with due date …" → The vendor already has an open evaluation. Your risks were added to it and its expiration date was kept.

"File type is not supported" → Use one of the file types listed under File limits.

"Total file size exceeds the limit of …" → Upload the files in smaller batches.

The risk list looks empty → A status card may still be selected. Click All and clear the search box.

Need more help? Contact support@zeron.one