All risk assessments in Diri start with a registration. The registration documents what is being assessed, by whom and within which limits. This is important for auditing and traceability, and the information is included in the report print.
- In the left menu, open Risk Assessment under Operational risk or Cyber security, depending on which module the assessment belongs to.
- Click New risk assessment. To start from a template instead, click Add from template (see Using templates).
- Fill out the Register risk assessment form and save. The assessment opens on its dashboard, with step 1 completed.
- Risk assessment name: The name shown in the list of risk assessments.
- Choose risk assessment type: What kind of object you assess. Depending on the type, you are asked to select the object from your registers, for example Select IT system, Select vendor, Select asset from registry or Select AI system. Only IT systems marked as AI systems in the IT system register can be selected as AI systems.
- Module: The module the assessment belongs to. This decides where it is listed, which risk matrix is used, and which treatments, threats and vulnerabilities are available.
- Description: What the risk assessment is about.
- Tags: Optional tags for sorting and filtering.
- Delimitations: Which risks, threats or vulnerabilities are included in the assessment, which are not, and why. An accurate scope is important for an accurate assessment.
- Choose implicated risk assessments (if any): Link other risk assessments that are affected.
- Risk assessment responsible: The person responsible for the assessment. When the assessment is sent for signing, the request goes to this person (see Signing and review).
- Add risks from template: Optionally copy content from a template into the new assessment.
The registration also documents who takes part in the assessment. In Who will participate in the assessment?, start typing to search the users in your organisation and select them. Participants who are not users in Diri can be added under Add external participants in the assessment (if any).
Some types ask for more. The organisational risk assessment, for example, asks about your most important deliveries, the IT systems they depend on, your largest concerns and existing security measures. See the risk assessment types for details.