Skip to main content
Risk Management adds a risk register to Compliance. Failed checks appear as gaps you can promote into tracked risks. Each risk has a likelihood, an impact, an owner, a treatment plan, and a target date. This page is for MSP staff who manage risks and for company users who read the risks shared with them.

​
Before you start

  • Risk tracking must be on. An MSP admin turns it on under Settings > Compliance > Risk. See Configure risk tracking and categories. If it is off, you see Risk tracking is disabled with an Open Risk settings button.
  • You need Compliance read access to view risks.
  • Only internal MSP users with Compliance write or manage access can create, edit, approve, or dismiss. Company users do not see Unaddressed gaps, and they see only risks shared with them.

​
Find and read a risk

1

Open Risks

Click Compliance in the sidebar, then the Risks tab. The page is titled Risk Register.MSP Demo risk header with Risk register and Unaddressed gaps tabs and the gap count
2

Pick a tab

Choose Risk register or Unaddressed gaps in the page header. The count beside Unaddressed gaps is the number of gaps waiting for review. Company users see only Risk register.
3

Read the summary cards

The cards show Active risks, High and critical, Overdue treatment, and Accepted risks.
4

Filter the register

Use Search risks… and the filters for Category, Severity, Status, Owner, Target from, and Target to. Click Clear filters to reset. The table is paged, so one page is not the whole register.
5

Open a risk

Click a row, or open its Risk actions menu and choose View risk. The details show the statement, owner, target date, likelihood, impact, treatment plan, and visibility.
The risk details can also show:
  • Source compliance finding, with Open source to jump to the check. A strategic risk has no source.
  • Linked remediation work: the PSA ticket, Planner items, and evidence files attached to the source finding.
  • Failure occurrences: how often the source check failed. A repeat failure adds to the count and does not create a duplicate risk.
  • Risk dependencies: Depends on and Required by.
  • Risk history: a log of edits.
  • A Source is now compliant badge once the check passes. The badge does not review the risk, finish treatment, or close it.
Company users only open linked records they already have access to.

​
Promote a compliance gap

1

Open Unaddressed gaps

On Compliance > Risks, click Unaddressed gaps. Each row is a failed check with its company and Failed on date.
2

Add it to the register

Open the row menu and choose Add to risk register. The Add compliance gap to risk register editor opens, filled in from the check. Nothing is saved yet.
3

Review the fields

Check Risk title, Risk statement, Category, Likelihood, Impact, Owner, Target date, and Treatment plan. Criticality hints at impact, priority describes how urgent the fix is, and only likelihood times impact sets the Risk score.
4

Set visibility

Check Visible to company users. A promoted gap can carry over the visibility of its source finding, so do not assume the switch starts off.
5

Choose the default category (optional)

Turn on Use this category for future failures to save the category as this check’s default. This changes the check, not only this risk.
6

Add the risk

Click Add risk. MSPortal shows Risk added to the register. Open the saved risk and check the assessment before you approve it for company users.
To skip a gap, open its row menu, choose Dismiss, type a Reason of at least three characters, and click Dismiss gap. Dismissing does not pass the check. If the check fails again later, a new gap appears.

​
Add a strategic risk

1

Start the risk

In the register header, click Add strategic risk.
2

Fill in the basics

Choose the Company, enter the Risk title and Risk statement, and choose a Category. Set Likelihood and Impact.
3

Add ownership and treatment

Choose an Owner, a Target date, and a Treatment plan. Under Dependencies, pick the upstream risks this one depends on. The list holds only risks for the selected company.
4

Save

Click Save changes. A strategic risk starts internal-only.

​
Score and track a risk

Likelihood and impact each run from 1 to 5. The score is their product. To edit a risk, open its Risk actions menu, choose Edit risk, change the fields, and click Save changes. Closed risks are read-only. If the check fails again later, a new gap appears.

​
Share a risk with company users

A company user sees a risk only when Visible to company users is on, an MSP user has set the status to Approved, and the user has Compliance access to that company.
1

Review internally

Create the risk and check it as MSP staff.
2

Approve and share

Edit the risk, turn on Visible to company users, set Status to Approved, and click Save changes.
3

Verify access

Check with the intended company role. An MSP preview does not prove what that user sees.
4

Withdraw sharing

To make a risk private again, turn Visible to company users off and save. Changing the status alone does not do this.
The approval is recorded the first time an MSP user sets the status to Approved. Moving the status to Mitigating or another value later does not clear it.

​
Categories and AI help

Categories apply to the whole tenant. Add, rename, recolor, reorder, and archive them in Risk settings. Archiving keeps existing risks. Category colors do not change severity.
Create risk category dialog with a blank name and default teal color.

An MSP administrator's unsaved category editor. Category setup is separate from an individual risk.

Compliance AI can rank gaps worth reviewing and draft a risk assessment. Use this assessment opens the standard risk editor with the draft. Nothing is saved until you click Add risk. See Compliance AI.

​
Report on risks

When risk tracking is on, the report builder offers five risk blocks. Dashboards support all but Risk Register. Check the company, period, and scope before you share a report. A summary is not the full list.

​
Troubleshooting

​
Frequently asked questions

Yes. MSP writers use Add strategic risk.
No. They read shared risks. MSP writers create, edit, and approve.
No. The risk also needs an Approved status and the user needs Compliance access to the company.
No. Turn Visible to company users off and save.
No. They can carry over the source finding’s visibility. Check the switch before you save.
Likelihood times impact, each 1 to 5. Priority and category color do not.
No. It also changes the source check’s default category.
No. It records why the gap is not a risk. The check result stays the same.
No. Read the Source is now compliant badge separately from the risk status.
No. It records ownership only.