Overview
The Risk module in Formalize provides a structured workflow for identifying, assessing, and managing risks. By combining configurable risk types, approval flows, and custom mitigation fields, the module ensures flexibility while supporting consistent risk governance across your organization.
Re-assess dimensions vs. Derive from mitigation items
Before treating a risk in Formalize, it is important to understand the two approaches Formalize uses to handle risk mitigation:
Re-assess dimensions: You manually define tasks and controls and assign new, subjective scores for Probability and Consequence.
Derive from mitigation items: Formalize automatically calculates residual risk based on fixed reduction percentages assigned to linked controls.
When using Derive from mitigation items, risk reduction follows one of two calculation models configured at the risk category level:
Cascading: Each control reduces the risk that remains after the previous one, so two controls reducing risk by 20% and 30% give a total reduction of 44% (20%, then 30% of the remaining 80%).
Additive: Each control’s reduction is added together, so two controls reducing risk by 20% and 30% give a total reduction of 50%.
Note: Prerequisite: The mitigation methodology (Re-assess dimensions vs. Derive from mitigation items) is defined when creating a Risk Category. This setting applies to all risks within that category and cannot be changed after creation. To use a different methodology, create a new Risk Category.
How to mitigate a risk with the strategy -> Derive from mitigation items
By default, the strategy for newly created risks is set to v1 - Strategy Pending.
Follow these steps to apply a calculated mitigation strategy:
1. Navigate to the Risks module and open the specific risk you want to treat
2. Click New treatment.
3. In the treatment window, select your desired mitigation strategy by opening the dropdown in the field Decision:
Accept
Avoid
Mitigate
Transfer
4. Fill out any custom mitigation fields that appear.
For details on how to create and configure these fields, refer to our guide on Risk Module Overview
5. Go to the Treatment items tab and click on Manage to add controls to mitigate the risk.
6. Select the relevant controls from the dropdown to link them.
7. For each selected control, specify the exact percentage reduction it will have on the risk once it is fully implemented.
8. Click Save changes
9. Review the final mitigation percentages for each control. These percentages are always based on the percentage selected in step 7 and the implementation status of the control.
10. Click Save to apply the mitigation. The final mitigation score will depend on if you selected Additive or Cascading mitigation in the configuration of the specific Risk Category. You can check risk score progression in the visual matrix.
Once you save your calculated mitigation strategy, Formalize automatically tracks your progress.
Treatment items: On the risk, you will see an overview of all linked mitigation connections, their current effectiveness status, and the numerical effect they will have on the risk once completed.
Target Score & Matrix: when you apply a new mitigation, the system generates a new risk version that is included in the matrix showing the risk score progression. This includes a target score, indicating exactly how low the overall residual risk score will drop once all mitigation controls are fully implemented.
Automatic Updates: As your team implements the connected controls, the overall risk score will automatically update and decrease based on the percentages you set during setup. Every automated score recalculation creates a new version entry. To view previous iterations:
Click the Clock icon on the top right of the risk view.
Select any version timestamp to inspect past scores.
(Automated score adjustments will list the author as System).
We hope this article was helpful!
If you have any additional questions, please reach out to us via chat in the bottom right corner of the page — our team is always happy to assist you further.