What Is This Module For?
The Risk Register module provides a centralised register of all identified compliance, legal, and information security risks — with likelihood, impact, owner, and mitigation tracking.
Step-by-Step Guide
- Go to Risk Register in the sidebar.
- Click "Add Risk" — enter risk title, description, category (DPDP / Information Security / Legal / Operational), and risk owner.
- Score the risk — set likelihood (1–5) and impact (1–5). dcomply calculates the risk score automatically.
- Record mitigation measures — describe what you are doing to reduce likelihood or impact.
- Set review date — high-risk items are flagged for quarterly review.
- Track risk status — Open, Mitigated, Accepted, or Transferred (insured).
Common Mistakes to Avoid
- Treating the risk register as a one-time exercise — Risks change. Review your register quarterly and after every incident.
- Not assigning risk owners — Every risk must have a named owner who is responsible for monitoring and mitigation.
Frequently Asked Questions
Q: Should the risk register include business risks or only IT/privacy risks?
A: dcomply's risk register focuses on compliance, privacy, and information security risks. Business risks are typically managed separately in an enterprise risk management framework.