Risk Lifecycle
An information security risk walks a flow whose shape is decided by how you choose to treat it. The treatment option chosen at the control step is what settles whether the risk waits for measures, is verified, and needs its residual risk formally accepted.
The states
| State | What happens |
|---|---|
| Draft | The risk is being written: the definition, the scope, the owners, the threat and vulnerability. |
| Rejection detailing | Where a rejected record lands to be corrected. Everything a draft may edit is editable again. |
| Revision | Where a new round starts. Only opening a revision puts a record here. |
| Pending approval | With the risk owners, who say whether the record was opened correctly. Not a score approval — there is no scoring yet. |
| Control | Where the initial scoring is entered, the treatment option chosen, the Annex A controls selected and the measures opened. |
| Waiting for measures | Parked until every measure closes. Nobody holds a task here and nothing is editable. |
| Verification | Where the residual scoring is entered and the measures are judged to have been enough. |
| Acceptance approval | Where the residual risk is formally accepted, with a justification. |
| Active | The risk in force for its chain. |
| Inactive | Stood down, or a preparation given up. |
| Old revision | Replaced by a later round. Kept distinct from Inactive so a reader can tell "superseded" from "withdrawn". |
The first approval is not a score approval
Pending approval asks one question: was this record opened correctly? Is the risk real, is the scope right, are the owners right, is the threat-and-vulnerability pairing sensible.
There is no scoring at that point — only the ownership fields are open. Scoring happens at the control step, after somebody has agreed the record is worth assessing.
The treatment option drives the flow
At the control step you choose one of four treatment options, and one property of that option decides the route:
| Option | Requires control selection | Route |
|---|---|---|
| Modify | Yes | Names at least one Annex A control, opens measures, waits, is verified |
| Retain | No | Skips measures and verification |
| Share | No | Skips measures and verification |
| Avoid | No | Skips measures and verification |
See Treatment Options.
The measure-free route skips two states, not one
A treatment that needs no measures has nothing to verify either. Both the wait and the verification step are skipped.
This is worth knowing because the intuition is wrong. Skipping only the wait would park an accepted risk on a verification step whose whole question is about work nobody did — asking somebody to confirm the effectiveness of measures that were deliberately not taken.
On that route the residual scoring is copied from the initial pass rather than left empty. The residual risk of an accepted risk is its current risk, and leaving it blank would show those risks unscored in the reports and in the Statement of Applicability.
Acceptance approval is conditional
The acceptance approval step is reached only when the residual band asks for it — when the band the residual score lands in carries requires acceptance approval. On the shipped bands that is High and Critical.
A risk whose residual score lands in Low or Medium goes straight into force.
The flag is read from the record, where it was written when the risk was scored — not from the band definition at the time of the move. Editing a band later cannot reroute a record that has already closed.
Acceptance approval is the one state that opens a field no other state does: the acceptance justification. That sentence is the evidence an ISO 27001 auditor asks for when a residual risk above appetite was signed off rather than treated further.
Closing the control step needs an answer
Either at least one measure exists, or the measure not required switch says none is needed. Never neither.
A risk closed with no measure and no such declaration would move on to waiting for measures — and that state has no screen from which a measure can be opened, so the record would park there permanently.
The rule is enforced on the move, so you will be refused at the point of completing the control step rather than discovering it later.
The measure not required switch is the control step's own answer, sitting beside the treatment option. It is not derived from the treatment option, because they answer different questions: must Annex A controls be chosen is not the same as is anything going to be done.
The switch carries over into a revision alongside the treatment option it was decided with. Left behind, every revision of a risk that needs no measures would read as needing them and park on that same wait.
If the measures were not enough
Both verification and acceptance approval can send the record back to the control step, where new measures can actually be opened, carrying the reason.
Neither sends it back to waiting for measures — no measure can be opened from there, so the record would be stranded waiting for work nobody could create.
Each step writes only its own fields
A step screen shows only the fields that step fills in. Earlier steps' fields are not shown locked; they are not shown at all, and the whole record is one View button away.
| Step | Writes |
|---|---|
| Draft, rejection detailing, revision entry | The record as a whole |
| Control | The initial pass, the treatment option, the selected controls, notes, files |
| Verification | The residual pass, notes, files |
| Acceptance approval, standing down, the flow's own moves | Nothing |
This separation is not cosmetic. If the control step could write the whole record, the fields it does not show would be submitted empty and cleared — the control step would wipe the owners it never displayed, and the acceptance approval would then have nobody to raise a task for.
A field a step may not fill is rendered as plain text, not as a disabled input. A greyed-out box invites a click that does nothing.
Rejection carries its reason, and there is no field for it
Rejecting asks for a reason, and it lands on the record's history rather than in a field on the form.
A field would keep only the last reason and record neither its author nor its date. The history panel keeps every round with both.
There is no Save button
Every editable field is stored by the action that takes the record out of the state it is in. A record being worked on is somebody's open task, and the way out of a task is to say what happens next.
Measures appear as cards, not a grid
The control step carries the risk's measures as a panel of cards, each showing the dates and the account of the work — the half of a measure a reader of the risk most wants.
A measure opens in a modal over the risk, and the panel refreshes from the measures alone rather than re-reading the risk. Re-reading it would discard scoring the assessor has typed and not yet saved.
The panel is hidden when measure not required is set. See Risk Measures.