Log and assess a risk

The reporter records the context, event, causes, impacts and links, and the system searches for similar records without automatic merging. The GRC officer decides whether to create, link or merge, and assigns the owner and review cycle. The owner assesses the inherent risk with an active model showing the formula, then links controls and their test results so the residual is calculated, and the system compares it with the risk appetite and suggests the path. The treatment plan is built with its actions, budget, dates and dependencies and approved by the owner and the approver, unit scores are aligned in a calibration session before independent approval, then execution is tracked and the score is reassessed after completion. GRC-UC-01 GRC-CALC-001 GRC-TEST-007/009 GRC-BR-002 GRC-BR-003 ENT-GRC-015 ENT-GRC-019 ENT-GRC-021 ENT-GRC-022 ENT-GRC-023 UX-REQ-008 NFR-REQ-003 DATA-REQ-016