> For the complete documentation index, see [llms.txt](https://docs.ruler.nl/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ruler.nl/risks/risk-assessments.md). # Risk assessments How to build a risk assessment, from linking the standard to scoring net risk. A risk assessment identifies the compliance risks your organisation is exposed to in one area, and documents how they are controlled. Each risk assessment contains one or more risks. Every risk is linked to the relevant standard from the Legal Framework and to the control measures from your library that mitigate it, and carries a net risk score, and optionally a gross one, that reflects its probability and impact. Under **Risks** in the menu, **Risk assessments** lists all risk assessments your institution has made as cards, each showing the name, a short description and the number of standards, risks and control measures in it.

## Creating a risk assessment {% stepper %} {% step %} ### Start a new risk assessment Click **+ New risk assessment**. Give it a title and a description, and choose whether to **Distinguish** between gross and net risk or make **No difference**. Save.

{% endstep %} {% step %} ### Link the standard The risk assessment opens with a first section, laid out as four columns: **Norms**, **Gross risk**, **Control measures** and **Net risk**. Start on the left: click **+ Add standards**, select the theme, and then tick the topic (or individual articles) from the Legal Framework the risk relates to. Save.

An empty section, ready to be filled from left to right

{% endstep %} {% step %} ### Add the risk Click **+ Add risk** under **Gross risk** and give the risk a name. The risk now appears under both Gross risk and Net risk. {% endstep %} {% step %} ### Describe and score the gross risk Click the risk under **Gross risk**. Choose a **Risk type**, write a short **Description** (up to 280 characters), and use the sliders to score probability and impact as they would be without any control measure. Save.

{% endstep %} {% step %} ### Add the control measures Click **+ Add control measure** and select the measures from your library that mitigate this risk. You can add several. {% endstep %} {% step %} ### Score the net risk Click the risk under **Net risk**. Tick the control measures that apply under **Control measures to link**, add an annotation per measure if useful, and score probability and impact again, this time taking the measures into account. Save. The risk now appears on the [Risk heatmap](/risks/risk-heatmap.md). If your organisation accepts the risk as it is, switch on **Accept gross risk** instead; no control measure is then needed.

Linking control measures and scoring the net risk

{% endstep %} {% endstepper %} To add another risk to the same risk assessment, click **Add new section** at the bottom and repeat the steps.

A risk assessment with two completed sections

## Editing a risk assessment Open the risk assessment and click the **properties** menu at the top right to edit its name or description, or to create a task from it. Click any risk in the risk assessment to change its scores or the linked measures. If you change the linked control measures, Ruler reminds you to adjust the net risk. A control measure whose revision date has passed is marked with a red exclamation mark in the risk assessment, so outdated measures stand out. {% hint style="success" %} **Ruler in practice** A risk assessment is not a one-off. Periodically reassess the risks in it: adjust the gross and net probability and impact, add, remove or change the linked control measures, and add new risks where they have appeared. If a risk exceeds your organisation's risk appetite, create a task to mitigate it further. Typical tasks are developing a new policy or procedure, or changing an existing one. {% endhint %}