Journey D, part 5: The compliance officer finds the breach in the Risk Register and assigns the treatment

Steps

1. 1

   Open the Risk Register

   In the left menu, under Risk and Governance, select Risk Register. It is the central list of risks from every module. Sync Modules, at the top right, looks through the company's other modules and adds what they have found as risks.

2. 2

   Select Sync Modules

   Select Sync Modules. After a few seconds a message reports how many risks were new, how many were updated and how many were closed.

   • Select Sync Modules
3. 3

   Make room and find the breach

   Select Hide above the right-hand panel, and the small collapse icon beside In this module, so the list has the full width. The breach is in the list. Its title starts Data breach, High, followed by the description the Data Protection Officer wrote. Source says Data Breach. The same sync brought in a second risk, with the source Contract Check: a clause the contract analysis flagged in Journey A. It is legal's to treat.

   • Select Collapse section list
4. 4

   Read the score

   Score shows 4 by 4, which is 16, and Level shows Critical. A breach logged as High arrives as likelihood 4, Likely, and impact 4, Major. Owner, Residual and Due are empty: nobody owns the risk yet. The heat map above the list now has one risk in that square.

5. 5

   Select the pencil to edit the risk

   At the end of the row, select the pencil, Edit. The form opens with the title, description, category and scores filled in from the breach.

   • Select Edit

   

6. 6

   Set the treatment status and the owner

   In Treatment Status choose Mitigating, which means work is under way. Under Risk Ownership, type the owner's name and sign-in e-mail address. The owner must be someone whose role includes the Risk Register, or the task will never reach them. Here the compliance officer owns it herself.

   • Choose Treatment Status: MITIGATING
   • Type Owner Name: Mariam Aziz
   • Type Owner Email: mariam.aziz@c17.example.com
7. 7

   Write the treatment plan and the due date

   In Treatment Plan, say what will be done to reduce the risk. In Treatment Due Date, set the date by which it must be done.

   • Type Describe how this risk will be mitigated...: Data Protection Officer to re-assess the fulfilment supplier. Supplier…
   • Type Treatment Due Date: 2026-11-13
8. 8

   Select Update Risk

   Select Update Risk. The row now shows the owner, the status Mitigating and the due date.

   • Select Update Risk
9. 9

   Find the treatment in My Actions

   Select My Actions in the left menu. The risk is listed under Assigned to me with the type Risk Treatment, from the Risk Register, with its priority and due date. It stays here until the risk is closed. The plan's first action belongs to the Data Protection Officer; these two are not linked by the system, so tell her. The next part shows her doing it.

   • Select My Actions