Overview

The Risk Register is where you record a risk, score it, decide how you will treat it, attach the evidence of what you did, and close it. Each risk moves through a four-step lifecycle, and its Treatment Status and Risk Score are visible on the main list at all times.

This guide covers the list, creating a risk, each of the four steps field by field, evidence documents, and the rules that decide when a risk can be closed.

Prerequisites

• defence:risk:view to open the Risk Register at all. Without it the page shows an Unauthorized screen.
• defence:risk:create to see the Create Risk button.
• defence:risk:manage to open a risk and work through its steps. Without it, clicking a risk shows an Unauthorized screen.
• defence:risk:documents:view to see the evidence documents attached to a risk.
• At least one tool visible under Admin → Integrations, because a risk must be linked to at least one connector when you create it.
• Some data already collected. Until Interno holds data, Risk Register is greyed out in the sidebar.

Opening the Risk Register

Navigation: Sidebar → Risk Register

1. Click Risk Register in the sidebar.
2. The list opens, newest risk first.

Columns on the list

Finding a risk

Click any row to open that risk on its first step.

Creating a Risk

Navigation: Sidebar → Risk Register → Create Risk

1. Click Create Risk at the top right of the list. The Create Risk dialog opens with the note Create a new risk linked to a connector.
2. Fill in the form. All five fields are required.
3. Click Create.

The dialog closes and the new risk appears at the top of the list. It has no score yet — scoring happens on step 2.

Working a Risk Through Its Lifecycle

Navigation: Sidebar → Risk Register → click a risk

The risk opens on its own page. A stepper lists the four steps as STEP 1 to STEP 4; completed steps show a tick. Click any step in the stepper to jump straight to it. Back to Risk Section at the top returns you to the list.

Every step shows the risk's current Treatment Status at the top, and every step after the first has a Go Back to Previous Step link.

Step 1 — Risk Initiation

1. Check or correct Risk Name, Risk Description, Risk Due Date and Assignee.
2. Check Choose Connectors. At least one connector must stay selected.
3. Click Save & Proceed.

All fields on this step are required.

Step 2 — Risk Scoring & Prioritization

The risk name and description are shown read-only for reference.

1. Choose Risk Likelihood.
2. Choose Risk Impact.
3. Risk Exposure fills in by itself. It is read-only.
4. Click Save & Proceed.

Each choice carries a weight: the four likelihood levels and the four impact levels are weighted 2, 5, 7 and 9 from lowest to highest. Risk Exposure on this step is likelihood weight multiplied by impact weight, divided by ten — so Almost Certain and Critical give 8.1, and Rare and Low give 0.4. The Risk Score column on the list is recalculated from the same two values every time you save this step.

Step 3 — Risk Management

1. Set Mark Risk As to the Treatment Status you want recorded.
2. Choose a Response Strategy.
3. Write the Response Plan.
4. If you chose Mitigate, two more fields appear: choose a Mitigation Strategy and write the Mitigation Plan.
5. Click Save & Proceed.

Step 4 — Risk Closure

1. Set Mark Risk As.
2. Choose Residual Risk Likelihood and Residual Risk Impact — the same scales as step 2, describing what is left after treatment.
3. Residual Risk Exposure fills in by itself.
4. Attach evidence under Evidence Documents (see the next section).
5. Click the button at the bottom of the step.

All three of Mark Risk As, Residual Risk Likelihood and Residual Risk Impact must be set before the step will save.

The button reads Save as Draft while the risk has no evidence documents, and Finish & Close Risk once it has at least one. What it does depends on Mark Risk As:

So a risk can only be closed as Completed once at least one evidence document is attached.

Evidence Documents

Navigation: Sidebar → Risk Register → click a risk → STEP 4 Risk Closure → Evidence Documents

1. Click Upload Evidences.
2. Drag a file into the upload area or click it to browse. Each uploaded file appears as a chip.
3. Repeat for any further files.
4. Click Submit.

The documents are then listed with Document Name, Uploaded On and Uploaded By. Click a row to download that document.

Note: The file picker lets you choose more kinds of file than the platform stores — for example archives, videos and text files. Anything outside the list above is refused when it is uploaded.

There is no way to remove an evidence document from a risk on this screen once it has been submitted.

What the Risk Register Does Not Do

• There is no edit or delete action on the list. To change a risk, open it and use step 1. Risks cannot be deleted from the screen.
• Risks are not created automatically from scans, alerts or dashboards. Every risk is raised by a person.
• Choosing connectors links the risk to those tools for reference. It does not pull findings from them into the risk.

Troubleshooting

The Risk Register shows an Unauthorized screen → You are missing defence:risk:view. Ask your administrator to grant it.

Risk Register is greyed out in the sidebar → Interno holds no data yet. Connect an integration or upload a workbook through Manual Ingestion first.

There is no Create Risk button → The button is shown only to users who hold defence:risk:create.

Clicking a risk shows an Unauthorized screen → Working a risk through its steps needs defence:risk:manage. Viewing the list alone does not grant it.

A step will not save → Every required field on that step must be filled in. If the message is about permissions, saving also needs defence:risk:update or defence:risk:manage.

"Description must not exceed 500 words" → The description, Response Plan and Mitigation Plan are each limited to 500 words. Shorten the text.

Risk Exposure is blank → It only appears once both Risk Likelihood and Risk Impact are chosen. It cannot be typed in.

"Mitigation strategy required" → You chose Mitigate as the Response Strategy, which makes Mitigation Strategy and Mitigation Plan compulsory.

The last step only offers "Save as Draft" → That is expected until you attach evidence. Use Upload Evidences; the button then reads Finish & Close Risk.

"Please upload at least one evidence document" → You set Mark Risk As to Completed with no evidence attached. Upload a document first.

I clicked Finish & Close Risk but stayed on the page → The risk only closes and returns you to the list when Mark Risk As is Completed. With any other status the step is simply saved.

My evidence file was refused → Check the type and size against the table above: PDF, Word, .xlsx, JPEG, PNG or CSV, up to 10 MB.

I cannot find a status called Resolved, Accepted or Closed → Those are not Interno statuses. The six Treatment Status values are Pending, Planning, In Progress, On Hold, Waived and Completed.

The Choose Connector list is empty → No tools are available to your organisation yet. See How to Configure Connectors/Integrations.

Need more help? Contact support@zeron.one