Skip to content
Contact support
  • There are no suggestions because the search field is empty.

Create and approve a mitigation plan

A mitigation plan describes what will be done and what risk level you expect afterwards.

A mitigation plan states what will be done about a risk and the risk level you expect to land on once it is finished. Plans move through a lifecycle, so it is always clear where one has got to.

 

 

Make a mitigation plan 

  1. Select the risk area and navigate to the operational overview
  2. Select the entity with the risk that need to be mitigated
  3. Select the three dots on the right of the risk scenario that should be mitigated
    risk handling menu
  4. Select Mitigate
  5. Fill out the mitigation plan
  6. Write a description of what will be done.
  7. Set the expected risk level after the plan is completed.
  8. Add the estimated cost and the financial exposure after mitigation. These help risk area responsibles and management decide whether the plan should be applied.
  9. Set a deadline for the plan. Plans past their deadline are counted as overdue in the risk overview.

    create-mitigation-plan
  10. Click Save. The plan is created with the status Proposed
  11. Now you will be able to find the plan under the Risk Area and "Mitigations overview"
 

Handle the mitigation

  1. Open the risk area and choose the Mitigation overview.
  2. Find the mitigation you want to plan.
  3. Open the plan status and set the status to Approved when it has been signed off.
  4. Now select the status "Planned" here you will confirm the deadline and responsible - and select if you want to create a task in the task management board.
  5. Now the plan can be carried out - and marked completed
  6. Completed plans can afterwards be "applied" so they will update the current risk level.
  7. You can apply multiple completed mitigations at once by selecting: Apply mitigations

Mitigation plans

Plans for entities and for the organisation

A risk assessed at organisational level is mitigated the same way: in the operational overview select Organisation instead of an entity, then use the three dots on the scenario. In the Mitigation overview, the Type column shows what each plan concerns: a processing activity, an asset, a legal entity or the organisation. The Entity column is left empty for organisational risks, and you can filter on type to see only those plans. See Assess risks at organisational level.

Mitigation overview with two proposed plans: one of type Asset on the entity ERP System, and one of type Organisation with the Entity column left empty

Move the plan forward in task management

  1. Open task management
  2. Find the task that corresponds with the mitigation plan
  3. Use the task to document your implementation of the plan.
  4. Mark the task as completed
  5. This will update the status in the mitigation overview.

When a plan is marked as applied, the current risk level updates automatically and the previous state is kept in the history.

Related Articles