Riskloop support and user guide

Contact: support@studiowebworks.com. We answer within two working days (Central European Time).

Getting started

1. Open a project and choose Risk register in the project sidebar (under Apps).
2. Press New risk, or open any issue and use the Risk assessment panel to add it to the register.
3. Set likelihood and impact (1 to 5), a treatment, a mitigation plan and the next review date. The owner is the issue's assignee.

Settings (project admins)

Project settings → Risk register: choose the template (ISO 31000 or ISO 27001), the issue type for new risks and the number of days until a new risk's first review, and until the next one each time someone presses Mark reviewed (1 to 365).

The close rule

The close rule stops a risk from being closed until it has an owner, a treatment and, unless the treatment is "Accept", a mitigation plan. Issues that are not in the register are never blocked.

A Jira administrator can turn it on with Enable close rule on the settings page. Riskloop adds the validator "Risk is ready to close" to every transition into a Done status in the project's workflows. To do it by hand, edit the workflow, select the closing transition and add the rule "Risk is ready to close".

Overdue reviews

Once a day Riskloop labels risks whose review date has passed with risk-review-overdue and notifies the owner once per review date. Saving a new review date removes the label.

After reviewing a risk, press Mark reviewed in the issue panel. Riskloop records who reviewed it, the date and the score in the panel's Review log (the last 20 reviews), and moves the next review date on by the project's review interval. The CSV export includes the last review date and reviewer.

The review log records reviews made in Riskloop. It is stored with the assessment on the issue, so it is not a tamper-proof audit trail: someone with permission to edit the issue could change it through Jira's REST API. For audit evidence, use it together with Jira's own issue history.

If the issue's edit screen has no Labels field, Riskloop cannot set the risk-review-overdue label. The assessment is still saved and the owner is still notified; the panel shows a warning once. Add Labels to the edit screen if you filter on the label.

Searching risks with JQL

• riskScore >= 10 — high and critical risks
• riskRating = critical — also high, medium, low
• riskTreatment = accept — also avoid, reduce, transfer
• riskNextReview < now() — reviews that are due
• riskLikelihood, riskImpact — the 1 to 5 values
• riskResidualScore — the score after treatment
• riskLastReviewed < -365d — risks not reviewed for a year

Use these in filters, dashboards and Jira Automation.

Scores and ratings

Score = likelihood × impact (1 to 25). Critical 20+, High 10+, Medium 5+, Low below 5. Residual likelihood and impact (shown once a treatment other than Accept is chosen) score the risk as it will be after treatment. On the register page, the After treatment (residual) switch moves the heat map and the table's rating column to those values; risks without residual values stay where they are.

Your data

Riskloop runs on Atlassian. Everything is stored in your Jira site. See the privacy policy.