The risk register holds organisational, participant, house and programme risks, each rated by likelihood and consequence before and after controls, with an owner and a review cycle. This tutorial covers adding a risk, managing controls, reviewing, and using the heat map.
Before you begin
- To add risks you need compliance.risks.create; to edit, add controls and close risks compliance.risks.update; to record reviews compliance.risks.review.
- For participant risks, check whether a participant risk assessment is the better route. See the note below.
Add a risk
- Go to Quality → Risk register and select Add risk.
- Describe the Risk (at least 4 characters), for example
Hot water above 50°C at a house. - Choose what it Applies to: Organisational, Participant, House or Programme. For a participant or house, choose which one; for a programme, type its name.
- Choose the Category and the Owner.
- Set Inherent likelihood and Inherent consequence: the rating before any controls.
- Under Controls, type one control per line: what is in place to prevent the risk or reduce the harm.
- Set Residual likelihood and Residual consequence: the rating with the controls working. Check the preview row, which shows both levels and the action required.
- Optionally set Next review. Leave it empty to use the review cycle for the residual level. Select Add risk.
Participant risks are usually raised from a participant risk assessment in Quality → Assessments, which links back to the register. Add one here only for a risk found outside an assessment.
Work with the register
- Use the tiles at the top to see live risks by residual level, Review overdue and Due in 30 days. Select a tile to filter.
- On the Register tab, use Rate by to switch the table between Inherent and Residual.
- Filter by Applies to, Level, Likelihood, Consequence, Owner, Status, Review due or Category.
- Select a row to open the risk drawer.
Manage controls and review a risk
- In the risk drawer, check each control and set its effectiveness: Effective, Partly effective, Ineffective or Not tested.
- To add a control, type it in Add a control and select Add.
- Under Review note, write what changed and whether the controls are working (at least 4 characters).
- Select Record review. The next review date is set from the risk’s review cycle and the note joins the Review history.
- Select Move to monitoring for a risk that is under control but still watched, or Edit to change its ratings.
Close or reopen a risk
- In the drawer, under Actions, type a Reason to close (at least 3 characters).
- Select Close risk. The risk stays in the register for audit.
- To reopen it, open the closed risk, type a Reason to reopen and select Reopen.
- To raise a change from a risk, select Raise an improvement.
Use the heat map and reviews
- Open the Heat map tab. Rows are likelihood (most likely at the top), columns are consequence; the small number in each square is the score.
- Select a square to see those risks in the register.
- Read Levels and action required, Likelihood and Consequence beside the map for what each rating means.
- Open the Reviews tab to see risks overdue or due in the next 90 days, grouped by Owner or Month.
Tips
- Inherent is the rating before controls. Residual is the rating with the current controls working as described. Participant risk assessments use the same scale.
- Link incidents to risks: the drawer lists Linked incidents so you can see whether a control is failing.
If something goes wrong
The residual rating cannot be higher than the inherent rating.
Lower the residual likelihood or consequence, or raise the inherent rating if it was underestimated.
Choose the participant. or Choose the house.
A participant or house risk must name one. Pick it from the list next to Applies to.
You can’t delete a reviewed risk
A reviewed risk stays in the register. Close it with a reason instead.
Record review is greyed out
Write a review note of at least 4 characters. Closed risks must be reopened before they can be reviewed.