The risk registry is a consolidated list of all the risks you can see in Diri, gathered from your risk assessments. It shows each risk's current and residual risk, who owns it and whether it has been accepted, and lets you accept or escalate risks without opening the underlying assessment.
Each module has its own registry. In the left menu, open Risk Registry under Operational risk (the Operational Risk Registry) or Cyber security (the Cyber Risk Registry). Privacy risks from DPIAs are listed in the Privacy Risk Registry under Privacy.
A risk in Diri is one path through a bowtie: a cause, the event it leads to, and one consequence of that event. One cause with several consequences therefore gives several risks. Risks are created inside risk assessments and gathered in the registry. See Step 3 - Bowtie risk assessment.
The colours follow your risk matrix, and acceptance criteria are shown in the risk matrix. Click a risk to open Risk details, with the cause → consequence relationship and the connected bowtie. Use View assessment to go to the assessment.
The summary above the list shows how many risks are shown, how many are accepted, how many acceptances have lapsed and how many risks have no owner.
From the actions on a risk you can:
Click Acceptance register to see all accepted risks. See Risk acceptance for details.
Click Add New Risk, select the risk assessment to add the risk to, and follow the guided risk wizard. The new risk is added to the selected assessment.
A treatment counts in a risk by its status in that assessment. A treatment implemented in one assessment and only planned in another lowers the current risk in the first and the residual risk in the second.