# Risk management in Probo

Use Probo's risk register to describe what could go wrong, then use a risk analysis to evaluate and treat it. This walkthrough follows one risk from its first description to a scored treatment plan and a reviewable record.

## How the records fit together

| Record         | Purpose                                                                                                                                          |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| Risk           | The named business or security risk, with its category, description, and notes. Reuse it across analyses.                                        |
| Scenario       | An explanation of how a risk could occur, recorded in a diagram within a risk analysis. It links the analysis to risks and, optionally, threats. |
| Treatment plan | The risk's owner, treatment decision, likelihood and impact scores, and linked internal controls for that analysis.                              |

Scores and ownership are set on treatment plans. Creating a risk alone does not assess it.

## Walkthrough: assess unauthorized access to customer data

You'll need permission to create risks, risk analyses, and treatment plans. To carry out the mitigation work, you'll also need access to internal controls and tasks. The names and scores below are illustrative; use your organization's scope and scoring method when assessing a real risk.

### 1. Create the risk

Open **Risk Management → All Risks**, select **New Risk**, and complete these fields:

| Field         | Example                                                                                                                                                                   |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Risk category | **Cybersecurity**                                                                                                                                                         |
| Risk name     | Unauthorized access to production customer data                                                                                                                           |
| Description   | A compromised administrator account could allow an attacker to export customer data from production, causing a confidentiality breach and disrupting customer operations. |
| Note          | Record the affected systems, assumptions, and evidence behind the assessment.                                                                                             |

You can choose a template after selecting a category, then adapt its name and description. Select **Create risk**. Probo assigns a reference ID so you can identify the same risk in later analyses.

### 2. Create an analysis with a clear scope

Open **Risk Management → Risk Analyses** and select **New Risk Analysis**.

- Name it `Production customer data access`.
- In **Description**, define the systems and data in scope, the assessment horizon, and how your team interprets likelihood and impact.
- Choose **5×5** for **Matrix size** to follow the example below. Probo also supports 3×3 and 4×4 matrices.
- Set **Period start** and **Period end** if the analysis covers a defined period, then select **Create**.

Use the same scoring method throughout an analysis so its scores are comparable.

### 3. Link the risk to a scenario

Open the analysis, select **Diagrams**, and choose **Add Diagram**. Name the diagram `Production access`, then expand it.

In **Scenarios**, select **Add**. Name the scenario `Stolen administrator credentials allow a customer data export`. Describe the entry point and consequences, select the risk you created under **Risks**, and select **Add**.

A risk must be linked to a scenario in the analysis before you can create its treatment plan. If the risk is missing from the treatment-plan selector, check this link first.

For a fuller threat model, add nodes, processes, boundaries, and threats to the diagram, then link relevant threats to scenarios. The scenario-to-risk link is still what makes the risk available for treatment.

### 4. Score the risk and assign its treatment

Open **Risks and Treatment Plans**, select **Add treatment plan**, and choose the linked risk. Set an **Owner** who will follow the treatment through, then choose **Mitigate** under **Treatment**.

The other treatment choices are **Accept**, **Avoid**, and **Transfer**. Choose the decision that matches what your organization will actually do.

Set **Impact** and **Likelihood** for both **Inherent risk** and **Residual risk**:

| Assessment                                  | Likelihood   | Impact          | Score |
| ------------------------------------------- | ------------ | --------------- | ----- |
| Inherent: before the proposed controls      | 4 — Probable | 4 — Significant | 16    |
| Residual: target after the controls operate | 2 — Remote   | 4 — Significant | 8     |

Probo calculates each score as likelihood × impact. In this example, stronger authentication reduces the chance of compromise, while a successful breach could still have a significant impact. Explain that reasoning in the analysis description or the risk's note.

Select **Create treatment plan**. Residual scores are a treatment target; entering a lower number does not establish that the controls work. If you choose **Accept**, residual likelihood and impact must equal the inherent values, and the plan cannot have linked internal controls.

### 5. Connect the treatment to work and evidence

Expand the treatment-plan row. Use **New internal control** or **Link internal control** to attach the controls supporting the treatment, for example:

- Require MFA for all production administrator accounts.
- Review privileged access every quarter.

Open each internal control to track its implementation. Use its **Tasks** tab to assign work with a deadline, such as enforcing MFA or checking the administrator list. Attach evidence supporting the control's operation. See [Compliance program](/docs/product/compliance-program) for the relationship between controls, tasks, and evidence, and [Tasks](/docs/product/tasks/overview) for recurring work.

The analysis shows inherent, net, and residual risk. **Net** uses the residual values only when at least one internal control is linked to the plan and every linked control is **Implemented**. Otherwise it uses the inherent values. Check the evidence as well as the implementation states before relying on the result.

You can also open the risk's **Treatment Plans** tab to see the analyses in which it is treated.

### 6. Review and publish the result

Review the scenario, scoring rationale, owner, treatment, linked controls, and supporting evidence with the responsible team. Update the treatment plan from its **Edit** action when the decision or scores change.

Use **Publish** on the analysis to create a document version. Select approvers if your review process requires approval, or publish directly when appropriate. The risk list also has its own **Publish** action. These documents capture a version for review; publishing does not close the risks or prevent continued updates.

Create a recurring task for the next review and revisit the analysis when systems, vendors, controls, or assumptions change. A review task gives the work an assignee and deadline; the risk itself has no next-review-date field.

## Automation

- [CLI risk](/docs/developers/cli/commands/risk) — Manage risk register entries with prb risk
- [CLI risk analysis](/docs/developers/cli/commands/risk-analysis) — Work with threat-based risk assessments
- [MCP risks](/docs/developers/api/mcp/tools/catalog/risks) — Query and update risks from supported AI tools
- [MCP risk assessments](/docs/developers/api/mcp/tools/catalog/risk-assessments) — Operate structured risk assessments through MCP
- [n8n Risk](/docs/developers/api/n8n/resources/risk) — Automate risk register operations in n8n
- [n8n Risk Analysis](/docs/developers/api/n8n/resources/risk-analysis) — Automate risk assessment operations in n8n