Overview
The Risk module in Formalize provides a structured workflow for identifying, assessing, and managing risks across your organization. By combining configurable risk types, custom fields, and mitigation strategies, the module ensures operational flexibility while maintaining consistent risk governance.
Navigating the Risk Module
You can go to the Risk module from the side navigation menu, by clicking on Compliance > Risks.
The main Risks page displays an overview card for each configured risk category. Each card contains:
Risk List: A preview table of the risks assigned to that risk category, with information on the assigned responsible users, inherent risk score, residual risk score, and the treatment strategy.
Risk Matrix View: A dedicated button to open the interactive risk matrix for each risk category.
Available Actions
From the Risks main page, you can perform the following actions:
Add a Risk: Click Add Risk on any risk category card to log a new risk entry - or from the top right corner and select to which risk category it will be assigned on the next step.
Manage Risk Categories: Click Manage Categories in the top-right toolbar to access Settings and edit, reorder, or create new risk categories (Settings permissions required).
Creating Risks
Click Add Risk on any risk category card or in the upper-right corner of the Risk module.
Complete the required entry fields:
Risk category: Select the risk category to which the risk belongs.
Name: A clear title for the risk.
Probability & Consequence Values: Select the score values for each axis. The overall Risk Score will auto-calculate based on your Risk Category configuration settings.
Custom Fields: Fill in any additional custom fields.
Click Save.
Configuring Risk Settings
To configure how risks are categorized, scored, and documented, go to Settings > Compliance > Risks. Alternatively, you can click on Manage categories from the Risks main page.
From this admin panel, you can manage the following areas:
Risk Categories
Mitigation Fields
Folders
Risk Categories
Risk categories categorize risks (e.g., Operational, Legal, Information Security) and define their scoring models. Each risk category maintains its own tailored matrix grid ranging from 3x3 up to 10x10.
Adding a New Risk Category
Go to Settings > Compliance > Risks > Risk Categories
Click + Add Risk Category.
Enter the name of the risk category.
Select a Treatment strategy (Derive from mitigation items or Re-assess dimensions).
Click Create risk category.
Customizing methodology dimensions and calculations
Click on any existing Risk Category to open its configuration panel. Here you will find two tabs, General and Visuals and graphs:
General
Risk category details: from here, you can update the name of the risk category.
Methodology dimensions: The factors each risk is scored on, such as probability and consequence. By clicking on the Settings symbol you can:
Rename the dimension name to match your internal framework.
Select if you would like the value of this dimension to be selected manually from a dropdown (Value source > Manual) or if it should be calculated based on other fields (Value source > Range assigned)
By clicking on Edit option lanes, you can:
Add or remove dimension levels
Assign numeric values to the dimensions
Assign description and custom color codes to each of the dimensions. with numeric values, description and custom color codes.
Click Save when you have made all needed changes.
Base Risk Calculation: define how the risk is calculated:
Sum: Probability + Consequence
Multiply: Probability * Consequence
Custom: Calculate using custom field variables.
Risk appetite threshold: Risks scoring above this level are outside the risk appetite.
Risk treatment settings: Here you can check the chosen mitigation methodology, but it can no longer be modified after the creation of the risk category. If you selected Derive from mitigation items, here you can choose if you would like a Cascading or an Additive mitigation strategy.
Cascading: Each mitigation reduces the score left by the previos ones. For example, if you apply two controls that mitigate 50% each, the first control will mitigate the full 50%, but the second one will mitigate 25%, as it mitigates the 50% of 50%.
Additive: Each mitigation reduces a percentage of the inherent score. For example, a risk with control that mitigates by 20% and another control that mitigates by 25% will in total be mitigated a 45%. If you select an Additive mitigation, you can also establish a Default impact cap (%): this is the most that a treatment can reduce the risk score when its items are summed.
Visuals and Graphs
Preview of visuals: see how the matrix of this risk category will look, based on the configured dimension values, risk score lane, and your risk appetite threshold.
Risk score lanes: Define the levels a risk score can fall into and the score range each level covers. You can edit these lanes by clicking on Edit scoring lanes.
Mitigation Fields
Mitigation fields work like Custom fields but appear exclusively when you apply a new treatment strategy to a risk. They allow teams to capture structured strategy details beyond standard text comments.
These fields will automatically appear under the treatment tab when applying a new treatment (or editing one) and on risk entries underneath the risk dimensions.
Custom fields
Custom fields allow you to track additional metadata on risk entries. Additionally, single-select numeric custom fields can act as drivers to automatically calculate the Consequence or Probability score of a risk.
If this is your desired configuration, navigate to Settings > Compliance > Risks > Custom Fields to add single-select fields. Remember that each option should have an associated numerical value.
Then, go to the risk category whose consequence or probability you want to calculate based on those values. Click on the Settings sign next to the dimension you want to calculate, and select Value Source > Range assigned. From here, you can define the formula by selecting options from the dropdown in Dimension formula. You can use Minimum, Maximum, Average and Sum and select the fields to be computed. You can also use Conditionals (IF) functions.
Consequence Scoring Example: You can create custom fields for Financial Impact, Reputational Impact, and Operational Impact. Add numeric values to the options as explained in Custom fields for Numeric Calculations.
We hope this article was helpful!
If you have any additional questions, please reach out to us via chat in the bottom right corner of the page — our team is always happy to assist you further.