Creating and assessing risks

Create a Jira issue that is defined as either a primary or supplementary risk type, and click on the Risk assessment button to cause the risk assessment panel to appear. Note that if you create an issue using the Add a risk menu item from the risk register and matrix screen, it automatically adds the risk assessment panel.

If this button is not available, you must modify the risk configuration project settings to include your nominated issue type as a primary or supplementary risk type.

The risk assessment panel appears when a Jira issue has risk information embedded in it or when you click on the Risk assessment button (see above). This panel enables you to define risk information for the issue.

By default, the probability and impact fields are unspecified. In order to modify this information, you must press the Modify button. You can then set the inherent probability and impact fields using the slider controls:

Inherent probability is the initial probability of the risk being realized, before any treatments have been applied.

Inherent impact is the initial impact of the risk if realized, before any treatments have been applied.

Inherent risk is calculated using the risk model defined on the application settings page, and is based on the inherent probability and impact.

Save stores the risk information in the issue and restores the risk assessment panel to read-only mode.

Cancel discards any changes you have made and restores the risk assessment panel to read-only mode.

Remove deletes all risk information from the issue.

Specify residual risk makes the residual probability, impact, and level of risk fields appear.

Specifying residual risk

The application allows you to specify the residual risk. This is the risk exposure that is left over after you’ve applied your risk treatments. In other words, it is the amount of risk remaining after your plans to avoid, reduce, and transfer the risk have been executed. This option is useful for those organizations that require you to track the level of risk exposure before and after treatment. Some organizations only require you to track a single level of exposure, in which case this option should not be used.

Residual probability is the probability of the risk being realized, after any treatments have been taken.

Residual impact is the impact of the risk if realized, after any treatments have been taken.

Residual level of risk is calculated using the risk model defined on the application settings page, and is based on the residual probability and impact.

You can hide the risk assessment panel by clicking on Hide Risk assessment in the action menu. This option is not available if your issue is of the primary risk type.

This action does not delete the risk assessment; it just hides it. The risk still appears on risk registers and matrices. If you subsequently click the Risk assessment button, the risk assessment reappears in its former state.

You can record treatment information for the risk and have it appear in the risk register (see Viewing risk registers and matrices). Follow these steps:

1. Enable risk treatments in the settings page (see Administering the application). 
2. Create a Jira issue to represent the treatment. Task is commonly used for this, but any Jira issue type is fine.
3. On the risk page, click the Link icon .
4. In the Linked Issues panel, choose the treatment link you specified in step 1, and the issue you created in step 2.

The history of risk changes can be viewed under the Risk assessments tab in the activity area of the screen.