Risks

A risk is an atomic, evidence-driven finding in your workspace. Risks have one or more assets (one of them primary) and progress through a status lifecycle from intake to closure. Scoring derives from attached evidence as Inherent and Residual values computed from the evidence model. A risk also has an origin (Design, Test, or Monitor) once it has evidence — a new risk with no evidence yet has none.

Risk Lifecycle

All risks start in Triage. From there:

Accept moves the risk to Open.
Archive sets it aside. Archived risks stay in the list, greyed out and sorted last, and archiving is reversible (see Archived risks).

Once open, risks advance through Open → In Progress → In Review → Closed. Archive is available from any state, not just Triage. Archiving a risk that is already past Triage moves it out of the active view in one step without changing its lifecycle status.

These are the same status labels shown everywhere (the risks list, the Risk Details page, and PDF reports): Triage, Open, In Progress, In Review, Closed, and Archived.