Overview
The Risk module in Formalize provides a structured workflow for identifying, assessing, and managing risks. By combining configurable risk types, approval flows, and custom mitigation fields, the module ensures flexibility while supporting consistent risk governance across your organization.
Re-assess dimensions vs. Derive from mitigation items
Before treating a risk in Formalize, it is important to understand the two approaches Formalize uses to handle risk mitigation:
Re-assess dimensions: You manually define tasks and controls and assign new, subjective scores for Probability and Consequence.
Derive from mitigation items: Formalize automatically calculates residual risk based on fixed reduction percentages assigned to linked controls.
When using Derive from mitigation items, risk reduction follows one of two calculation models configured at the risk category level:
Cascading: Each control reduces the risk that remains after the previous one, so two controls reducing risk by 20% and 30% give a total reduction of 44% (20%, then 30% of the remaining 80%).
Additive: Each control’s reduction is added together, so two controls reducing risk by 20% and 30% give a total reduction of 50%.
Note: Prerequisite: The mitigation methodology (Re-assess dimensions vs. Derive from mitigation items) is defined when creating a Risk Category. This setting applies to all risks within that catetgory and cannot be changed after creation. To use a different methodology, create a new Risk Category.
How to Manually Mitigate a Risk
By default, the strategy for newly created risks is set to v1 - Strategy Pending.
To manually update the strategy:
1. Navigate to the Risks module and open the specific risk you want to treat.
2. Click New treatment.
3. In the new treatment window, select your desired mitigation strategy by opening the dropdown in the field Decision:
Accept
Avoid
Mitigate
Transfer
4. Fill out any custom mitigation fields that appear.
For details on how to create and configure these fields, refer to our guide on Risk Module Overview
Adding Mitigation Controls and Tasks
While updating a risk strategy, you can connect specific controls or tasks to act as mitigation measures.
To connect controls or tasks:
Click on Treatment items > Manage
Select the relevant tasks or control
You can also click on + to instantly draft and link a brand-new mitigation task without leaving the window.
Adjusting Risk Scores and Version History
Once your strategy and controls are defined, you must set the new risk score.
In the Risk score section of the window, manually adjust the risk's Probability and Consequence levels based on your mitigation efforts.
Click Save to generate your new residual risk score.
The system will create a new risk version and include it in the visual matrix showing the risk score progression.
Your newly saved risk strategy is stored in the Version history. By clicking on the clock, you can go to any previous version and review the historical progression of the risk at any time.
Common Questions
Can the naming of 'Consequence' and 'Probability' be changed?
Yes, you can do this in Settings > Compliance > Risks > Risk Category.What is the maximum size of the risk matrix?
The risk matrix can range from 3×3 up to 10×10. It is configured within Settings > Compliance > Risks > Risk Category by adjusting and modifying the levels of Consequence (x-axis) and Probability (y-axis).
We hope this article was helpful!
If you have any additional questions, please reach out to us via chat in the bottom right corner of the page — our team is always happy to assist you further.