Risk Management Module Documentation

Module Overview

The Risk Management module provides a comprehensive risk register supporting both Traditional (Impact × Likelihood) and FMEA (Severity × Occurrence × Detection) methodologies. Risks are linked to strategic goals, KPIs, and controls for integrated risk management.

Why Risk Management Matters

Effective risk management is the cornerstone of organizational resilience. StrataGRC's risk register enables you to:

Identify Risks

Capture and categorize risks across your organization with structured assessment

Assess Impact

Quantify risk exposure using proven methodologies (Traditional or FMEA)

Link to Controls

Map risks to mitigating controls and track effectiveness

Monitor Trends

Track risk evolution over time with historical audit trail

Implementation Tip

Choose your risk methodology based on industry standards. Traditional method is simpler and widely used. FMEA provides more granular assessment, preferred in manufacturing, healthcare, and engineering sectors.

Risk Assessment Methodologies

StrataGRC supports two industry-standard risk assessment methodologies. Your organization's methodology is configured in Organization Settings.

Traditional Method

Two-factor risk assessment focusing on impact and likelihood. Simple, intuitive, and widely adopted.

Risk Score = Impact × Likelihood
Range: 1-25

Factor	Scale	Description
Impact	1-5	Severity of consequences if risk occurs
Likelihood	1-5	Probability of risk occurring

Low: 1-6 Medium: 7-15 High: 16-20 Critical: 21-25

FMEA Method

Three-factor assessment from Failure Mode and Effects Analysis. More granular, preferred in engineering.

RPN = Severity × Occurrence × Detection
Range: 1-1000

Factor	Scale	Description
Severity	1-10	Impact severity if failure occurs
Occurrence	1-10	Frequency of failure occurrence
Detection	1-10	Ability to detect before impact (10=undetectable)

Low: 1-100 Medium: 101-400 High: 401-700 Critical: 701-1000

Traditional Method Details

Impact Scale (1-5)

Score	Level	Financial Impact	Operational Impact
1	Negligible	< ₦100K	Minor inconvenience
2	Minor	₦100K-500K	Localized disruption
3	Moderate	₦500K-2M	Department affected
4	Major	₦2M-10M	Multiple departments
5	Severe	> ₦10M	Organization-wide

Likelihood Scale (1-5)

Score	Level	Probability	Frequency
1	Rare	< 5%	Once in 10+ years
2	Unlikely	5-20%	Once in 5-10 years
3	Possible	20-50%	Once in 2-5 years
4	Likely	50-80%	Once per year
5	Almost Certain	> 80%	Multiple times/year

// Traditional Risk Score Calculation $inherent_impact = 4; // Major impact $inherent_likelihood = 3; // Possible $inherent_risk_score = $inherent_impact * $inherent_likelihood; // Result: 12 (Medium Risk)

FMEA Method Details

Severity Scale (1-10)

Score	Effect	Description
1-2	Minor	No impact on operations
3-4	Low	Minor disruption, easily recovered
5-6	Moderate	Moderate disruption, recovery possible
7-8	High	Significant disruption, difficult recovery
9-10	Very High	Catastrophic, recovery unlikely

Occurrence Scale (1-10)

Score	Frequency	Probability
1-2	Remote	< 1 in 100,000
3-4	Low	1 in 10,000
5-6	Moderate	1 in 1,000
7-8	High	1 in 100
9-10	Very High	> 1 in 10

Detection Scale (1-10)

Score	Detection Ability	Controls
1-2	Almost Certain	Multiple automated controls
3-4	High	Effective manual controls
5-6	Moderate	Some controls in place
7-8	Low	Limited controls
9-10	Remote	No controls, undetectable

// FMEA RPN Calculation $severity = 7; // High severity $occurrence = 4; // Low occurrence $detection = 6; // Moderate detection $rpn = $severity * $occurrence * $detection; // Result: 168 (Low-Medium Risk)

Detection Factor Note

Unlike Severity and Occurrence, higher Detection scores are worse. A score of 10 means the failure is undetectable before impact, while 1 means it will almost certainly be detected early.

Using the Risk Register

Create a New Risk

Navigate to Risk Register, click "Add Risk". Enter risk title, description, and category. Select your risk owner from the dropdown.

Assess Inherent Risk

Rate the risk using your organization's methodology:

Traditional: Impact (1-5) and Likelihood (1-5)
FMEA: Severity (1-10), Occurrence (1-10), Detection (1-10)

The system auto-calculates the inherent risk score.

Link to Strategic Goals (Optional)

If this risk impacts strategic objectives, link it to relevant strategic goals. This enables risk-aware strategy execution.

Link to KPIs (Optional)

Connect risks to KPIs they might impact. When KPI thresholds are breached, linked risks are automatically reassessed.

Set Risk Status

Track risk through its lifecycle:

Identified: Risk logged, awaiting assessment
Assessed: Risk scored, ready for response
Response Required: Action plan needed
In Mitigation: Controls being implemented
Monitoring: Active monitoring phase
Closed: Risk accepted or eliminated

Risk-Control Mapping

Linking Controls to Risks

Controls are measures that reduce risk. Mapping controls to risks enables you to:

Track Mitigation: See which controls address which risks
Assess Effectiveness: Monitor control test results
Calculate Residual Risk: Risk remaining after controls
Identify Gaps: Find risks without adequate controls

How to Link Controls

From Risk Detail Page

Open a risk, scroll to "Linked Controls" section. Click "Link Control", select from existing controls, and save.

View Control Test Results

Linked controls show their latest test result (Passed/Failed/Not Testable). This provides real-time insight into control effectiveness.

Unlink Controls

If a control no longer mitigates a risk, click "Unlink" to remove the mapping.

// Risk-Control Integration Flow Risk (ID: 5) → risk_control_mapping → Control (ID: 12) ↓ control_testing ↓ test_result = "Passed" effectiveness_score = 4 ↓ Risk residual score updated

Integration Flow

When a control fails testing, the linked risk is automatically flagged for reassessment. This ensures risk registers stay current with control performance.

Mitigation Tracking

Risk Mitigation Tasks

Break down risk responses into actionable tasks. Each task can be assigned, tracked, and marked complete.

Assign Tasks

Assign mitigation tasks to specific users with clear ownership

Set Due Dates

Define deadlines and track overdue tasks automatically

Priority Levels

Set task priority (Low, Medium, High, Critical) for triage

Track Progress

Update task status from Not Started to Completed

Risk Response Workflow

Request Response

For risks requiring action, click "Request Response" and set a deadline. The risk owner receives notification.

Create Mitigation Tasks

Break down the response into specific, actionable tasks. Assign each task to responsible individuals.

Monitor Completion

Track task progress. When all tasks are completed, the risk status automatically updates to "Monitoring".

Update Risk Status

As mitigation progresses, update the risk status and action plan. All changes are logged in risk history.

Audit Trail

Every change to a risk (score updates, status changes, task completions) is logged in the risk_history table with timestamp and user. This provides complete accountability and regulatory compliance.

Module Integrations

How Risk Management Connects to Other Modules

Strategic Goals

Risks linked to strategic goals enable risk-aware strategy execution. Goal owners see risks that could impact their objectives.

KPIs

Two-way integration: KPI breaches trigger risk reassessment, and high risks can flag at-risk KPIs for monitoring.

Control Library

Risk-control mapping shows which controls mitigate which risks. Control test results inform residual risk assessment.

Audit Management

High risks can trigger audit engagements. Audit findings can create new risks or update existing risk scores.

Data Flow Example

// Integrated Risk-KPI-Control Flow 1. KPI "Customer Satisfaction" drops below threshold ↓ 2. Audit trigger created for Customer Service audit unit ↓ 3. Linked Risk "Service Quality Deterioration" reassessed ↓ 4. Risk score increased from 12 to 18 (Medium → High) ↓ 5. Control "Customer Feedback System" tested ↓ 6. Control effectiveness updated based on test result ↓ 7. Residual risk recalculated ↓ 8. Mitigation tasks created if needed

Automated Updates

The system automatically updates risk scores when:
• Linked KPIs breach thresholds
• Linked controls fail testing
• Audit findings identify new issues
• Mitigation tasks are completed

Best Practices

Risk Management Guidelines

Use Consistent Methodology

Stick to one methodology (Traditional or FMEA) across your organization for comparability. Don't mix methods unless you have specific regulatory requirements.

Define Risk Criteria

Before assessing risks, define what each score means for your organization. Document impact and likelihood scales with concrete examples.

Involve Risk Owners

Risk owners should participate in assessment. They understand the business context and can provide realistic impact and likelihood estimates.

Link to Controls Early

Don't assess risks in isolation. Always identify and link existing controls to understand current risk exposure (residual risk).

Review Regularly

Risks evolve. Schedule quarterly reviews for high risks, annual for others. Update scores based on control performance and business changes.

Track Mitigation Progress

Use mitigation tasks to break down risk responses. Assign clear owners and deadlines. Monitor completion rates.

Compliance Standards Alignment

ISO 31000 Risk Management:
• Risk Identification: Systematic identification of risks affecting objectives
• Risk Analysis: Traditional and FMEA methodologies for risk assessment
• Risk Evaluation: Risk matrices and scoring for prioritization
• Risk Treatment: Mitigation tasks and action plans
• Monitoring & Review: Ongoing risk monitoring and reassessment

COSO ERM Framework:
• Governance & Culture: Risk governance structure and oversight
• Strategy & Objective-Setting: Risk integration with strategy
• Performance: Risk identification, assessment, and prioritization
• Review & Revision: Risk response and mitigation tracking
• Information, Communication & Reporting: Risk reporting and communication

ISO 14971 (Medical Devices):
• FMEA Method: Severity × Occurrence × Detection scoring
• Risk Control: Mitigation measures and effectiveness verification
• Production & Post-Production: Ongoing risk monitoring

King IV Report on Corporate Governance:
• Risk Governance: Board oversight of risk management
• Risk Appetite: Defined risk tolerance levels
• Integrated Assurance: Coordinated risk assurance activities

Additional Resources

For more detailed guidance, refer to ISO 31000 (Risk Management) or ISO 14971 (FMEA for Medical Devices) depending on your industry.

Risk Management Module

📑 Module Contents