Who can use this feature
Supported on Foundation, Growth, and Scale plans
Risk Assessment allows you to assess a risk based on its factors and the risk score configured in your Scrut account. This process consists of three steps, as described below.
How To Assess a Risk in Scrut
Sign in to Scrut, and click Risk → Risk Management on the left navigation panel.
Go to the Risk Register tab, and click on the risk that you want to assess.
Click Start Assessment.
The risk assessment window opens.
Step 1: Calculate the Inherent Risk score
Drag the slider for each factor to modify its value, and the risk score will be automatically calculated based on the formula saved during its creation. Click Next.
Note:
The risk status changes from Open to Assessed after this step.
Step 2: Select Controls & Requirements
In this step, you will select controls that are specific actions or measures designed to mitigate the identified risk according to the chosen treatment strategy. You have two options to navigate this step:
Switch to Controls View: Select this tab to view the UCF controls you want to link to.
Switch to Requirements View: Select this tab to view framework requirements first, and then select controls.
Select the checkboxes that correspond with the controls you want to link. Click Next.
Pro Tip!
You can find a control quickly by using the searchbar and filters at the top of the window.
Step 3: Select the Treatment Strategy
Once you have linked the controls and requirements, the next step is to determine the appropriate treatment strategy. The treatment strategy outlines how your organization plans to address the identified risk.
Select an appropriate Risk Treatment Strategy from the following options:
Accept: Selecting this option means you are satisfied with the residual risk score and are willing to continue monitoring it.
Avoid: This option indicates that you have successfully managed to avoid the risk altogether, and you don’t need to take any further action.
Transfer: Select this option when a risk can be avoided and transferred to a third-party vendor.
Remediate: Select this option if the risk requires additional remediation treatment to reduce it further.
Optionally, you can also add a note justifying your choice of a specific risk treatment strategy.
Click Save.
Note:
The risk status changes from Assessed to Treatment in Progress after this step.
Step 4: Mitigation Task (Optional)
Check the box to create a mitigation task.
Once you select this checkbox, you will need to enter the following details:
Mitigation task name
Due date
Assignee
Description [Optional]
Note:
The controls linked in the previous risk assessment step will automatically populate under the Controls tab of the new mitigation task.
Click Save.
Note:
The risk status changes from Assessed to Treatment in Progress.
A new mitigation task will be created. Go to the Mitigation Task tab to view the controls listed under the Controls tab, which are also available from the Risk Control tab.
You can edit controls from the Risk Detail page. If you remove controls from the Risk Control tab, they will also be removed from the mitigation task. Adding new controls will not automatically update the existing mitigation task.
If you create a new mitigation task after linking new controls, the newly created task will include the new controls.
Note:
If a control linked to Risk is removed from the mitigation task, it does not affect the Risk Control tab. New controls added will also be linked to the risk.
Final Outcome
Once you have completed all the steps of the risk assessment, you will have a comprehensive and actionable risk assessment profile for the identified risk.