Risk Register

Overview

The Risk Register in Data Hub → Risks is where you keep track of what could go wrong, how likely and how harmful it is, and what you're doing about it. SOC 2, ISO 27001, and most privacy laws expect a documented, regularly reviewed risk assessment, and the register gives auditors one place to see it.

Each risk has an owner, a category, an inherent score (before treatment), a residual score (after treatment), a treatment plan, and a review schedule. Risks can link to the controls that reduce them and to the vendor they came from.

Who Can Use the Risk Register

The Risk Register is included in Premium and Enterprise plans of Concord Privacy or Concord Trust. Linking risks to controls also needs Controls, which are part of Concord Trust Premium and Enterprise.

Adding Risks

Go to Data Hub → Risks and add a risk. You can start from Concord's library of common risks, which fills in the description and suggests the controls that usually reduce it, or write your own.

For each risk, set:

• Title, description, and category.
• Owner: the teammate responsible for it.
• Inherent likelihood and impact: how likely the risk is and how bad it would be, before anything is done about it.
• Review frequency: annual, semi-annual, or quarterly.

Each risk gets a reference like R-001.

Importing and Exporting

To add or update many risks at once, choose Import CSV from the register's menu. Only a title column is required. A row whose key matches an existing risk, such as R-004, updates that risk instead of creating a duplicate, and rows with problems are reported one by one without stopping the rest of the file. Owners are matched by email. Choose Export CSV to download the register at any time.

Scoring

A risk's score is its likelihood multiplied by its impact. The score falls into a severity band, such as Low, Medium, High, or Critical, and the register shows each risk's band and a heatmap of the whole register.

The scale (5 by 5 by default) and the bands are yours to change: choose Scoring from the register's menu. Before you save, the page shows how your existing risks would move between bands, because changing a band re-scores every risk.

Treating Risks

On a risk's Treatment tab, choose a strategy:

Any strategy other than untreated needs a rationale. Mitigate and Transfer also take a residual likelihood and impact, so you can show how much the treatment reduced the risk.

When a mitigate, transfer, or avoid plan has a target date, Concord creates a task for the risk owner in My Work. Accepting the risk, closing it, or archiving it resolves that task.

Linking Controls

On a risk's Linked Controls tab, link the controls that reduce it. Each linked control shows whether it's currently passing, so you can see at a glance whether a mitigated risk is really covered. The register flags risks with no linked controls.

Reviewing Risks

Every risk has a next review date based on its review frequency. When a review is due, the owner gets a task, and one nightly check makes sure each overdue risk has exactly one review task. Choose Record Review on a risk to log the review. The reviewer can update the scores at the same time, and the next review date moves forward.

Where Risks Come From

Besides adding risks yourself, risks can come from other parts of Concord:

• Vendor reviews: a finding in a vendor review can become a risk linked to that vendor.
• Assessments: findings in an assessment can be promoted to the register.

Reports

Choose Reports from the register's menu to see the inherent and residual heatmaps, how many risks fall in each band and status, how many have a linked control, and how many reviews are overdue.