Risk Assessment Workflow

Why should we automate risk assessment instead of managing it through spreadsheets and email?

Manual risk tracking often relies on someone chasing status updates across spreadsheets, inboxes, and meeting notes, which makes it easy to lose track of where a risk stands. This workflow keeps every risk as a single record with a reference number, a current status, and a timeline of what has happened, so anyone checking progress can see it without asking around. Tasks are assigned directly to the risk owner, action owner, or senior management at each stage, reducing the coordination effort needed to move a risk forward.

What is the business case for using this template rather than building a custom process?

The template is ready to use, so a workspace can publish it and start running live risk assessments in minutes rather than commissioning a development project. Because the workflow already covers intake, assessment, approval routing, treatment, monitoring, and closure, teams avoid the cost and delay of designing that logic from scratch. Adjustments can still be made later by describing the change in plain English or editing steps directly in the workflow editor.

Who is involved in assessing and approving a risk, and what do they each do?

The risk owner records likelihood, impact, risk rating, and treatment details during assessment, and later completes treatment and closes the risk once monitoring is no longer needed. For risks rated High or Extreme, senior management is asked to approve the treatment plan before work proceeds. The action owner is responsible for completing treatment actions and recording the residual risk rating once treatment is underway.

What happens if senior management rejects a treatment plan?

If the approval outcome is rejected, the workflow routes the risk owner to a task where they record a revised treatment plan, due in 3 days. That revised plan is saved to the risk record's treatment actions field, and the workflow then resubmits it for a new approval cycle. This continues the process without requiring the risk to be re-entered or restarted from intake.

How does the workflow decide whether a risk needs senior management approval?

After the risk owner completes the assessment task, the workflow routes based on the risk rating that was recorded. Risks rated High or Extreme are sent to a senior management approval task before treatment can begin, while risks rated Low or Medium proceed directly to the Treatment Underway status. This routing happens automatically based on the rating entered on the assessment task.

Can the intake form or task fields be changed to match our internal risk categories or terminology?

Yes, the workflow can be adjusted by describing the change in plain English or by editing the relevant step directly in the workflow editor. This includes changing fields on the intake form, such as Business Area or Risk Category, or adjusting what the risk owner, action owner, or senior management are asked to record on their tasks. Earlier versions of the workflow are kept, so changes can be reviewed against what was previously in place.

How does the submitter stay informed about their risk without needing a login?

Submitters take part entirely through a public request form and emailed notifications, with no account required. They receive an acknowledgement email with their reference number after submitting, and a closure email once the risk has been resolved and closed. Both emails are sent automatically as part of the workflow's built-in email capability.

What information is retained on the risk record for later reference?

The record keeps the intake details, the assessment fields such as likelihood, impact, and risk rating, the treatment actions and target dates, any revised treatment plans, treatment completion notes, the residual risk rating, and closure notes. Each of these is saved because the relevant task is one the workflow waits for, meaning entries are persisted to the record rather than left only on the task. The record's timeline also shows the sequence of status changes, from Identified through to Closed.

Does this workflow help with compliance or audit requirements?

The workflow records statuses, the values staff enter at each stage, and a timeline of what happened on each risk record, which can support internal review and reporting. Each business should confirm its own compliance and record-keeping obligations, as the workflow itself does not determine or certify compliance. The structured record and timeline are intended to make information easier to retrieve when needed, rather than to represent a compliance outcome.

How long does treatment and monitoring typically stay open on a risk?

There is no fixed due date on the treatment completion or closure tasks, since these depend on how long treatment actions and monitoring take in practice. The action owner completes treatment and records a residual risk rating when ready, after which the status moves to Monitoring. The risk owner then closes the risk, recording closure notes, once it no longer needs to be monitored, and this timing is left to their judgment rather than a preset deadline.