Risk Management
Risk management is a core component of every compliance framework. Claw GRC provides a risk register with structured assessment, treatment tracking, and risk scoring based on the AIRSS (AI Risk Scoring System) methodology.
Risk Register
The risk register is a centralized inventory of all identified risks to your organization. Each risk entry captures:
| Field | Description |
|---|---|
| Title | A concise description of the risk |
| Description | Detailed explanation of the threat, vulnerability, or event |
| Likelihood | How likely the risk is to materialize (1-5 scale) |
| Impact | How severe the consequences would be (1-5 scale) |
| Risk Score | Automatically calculated as likelihood x impact (1-25) |
| Treatment | The chosen response strategy |
| Owner | The person responsible for managing this risk |
| Status | Current status (open, in_treatment, closed, accepted) |
Risk Scoring
Likelihood Scale
| Score | Level | Description |
|---|---|---|
| 1 | Rare | May only occur in exceptional circumstances |
| 2 | Unlikely | Could occur but is not expected |
| 3 | Possible | Might occur at some point |
| 4 | Likely | Will probably occur in most circumstances |
| 5 | Almost Certain | Expected to occur in most circumstances |
Impact Scale
| Score | Level | Description |
|---|---|---|
| 1 | Negligible | Minimal business impact, no data loss |
| 2 | Minor | Limited impact, recoverable within hours |
| 3 | Moderate | Significant impact, recoverable within days |
| 4 | Major | Severe impact, extended recovery, potential data loss |
| 5 | Critical | Catastrophic impact, regulatory penalties, major data breach |
Risk Matrix
The risk score determines the risk level:
| Impact 1 | Impact 2 | Impact 3 | Impact 4 | Impact 5 | |
|---|---|---|---|---|---|
| Likelihood 5 | 5 (Medium) | 10 (High) | 15 (High) | 20 (Critical) | 25 (Critical) |
| Likelihood 4 | 4 (Low) | 8 (Medium) | 12 (High) | 16 (High) | 20 (Critical) |
| Likelihood 3 | 3 (Low) | 6 (Medium) | 9 (Medium) | 12 (High) | 15 (High) |
| Likelihood 2 | 2 (Low) | 4 (Low) | 6 (Medium) | 8 (Medium) | 10 (High) |
| Likelihood 1 | 1 (Low) | 2 (Low) | 3 (Low) | 4 (Low) | 5 (Medium) |
Risk Treatment
Each risk must have a documented treatment strategy:
- Mitigate -- Implement controls to reduce the likelihood or impact. This is the most common treatment. Document what controls you are implementing and track progress.
- Accept -- Acknowledge the risk and take no action. Appropriate for low-scoring risks where the cost of mitigation exceeds the potential impact. Document the rationale.
- Transfer -- Shift the risk to a third party through insurance, outsourcing, or contractual arrangements.
- Avoid -- Eliminate the activity or process that creates the risk entirely.
Creating a Risk
- Navigate to Risks in the sidebar
- Click Add Risk
- Fill in the risk details:
- Title and description of the threat or vulnerability
- Likelihood and impact scores
- Treatment strategy
- Assign an owner
- The risk is created with the calculated risk score and
openstatus
Managing Risks
Risk Review
Risks should be reviewed periodically (at minimum quarterly) to update:
- Likelihood and impact assessments as the threat landscape changes
- Treatment progress and effectiveness
- Status updates (has the risk been mitigated? accepted?)
Linking to Controls
Risks can be linked to unified controls to show the relationship between your risk register and your compliance program. When a risk affects a specific control area, linking them helps auditors understand your risk-informed approach to compliance.
API Endpoints
| Method | Endpoint | Description |
|---|---|---|
GET | /api/v1/risks | List all risks |
POST | /api/v1/risks | Create a new risk |
GET | /api/v1/risks/:id | Get risk details |
PUT | /api/v1/risks/:id | Update a risk |
DELETE | /api/v1/risks/:id | Delete a risk |
Tips and Best Practices
- Involve stakeholders -- Risk identification should involve engineering, security, legal, and business stakeholders. Each group sees different risks.
- Be specific -- "Data breach" is too vague. "Unauthorized access to production database via compromised developer credentials" is actionable.
- Document treatment plans -- For every mitigated risk, document exactly what controls you are implementing and set a target date for completion.
- Review quarterly -- At minimum, review the risk register quarterly. Update scores based on new threat intelligence and completed mitigations.
- Connect risks to findings -- When a security assessment discovers an issue, create or update a risk entry. This shows auditors a connected risk management process.