Treatment plans and tasks

Treatment plans in risk management define strategies to address identified risks. These strategies aim to reduce the impact or likelihood of risks. Treatment plans typically include four approaches:

1. Avoidance: Eliminating the risk entirely.
2. Transfer: shifting the risk to another party, such as through insurance.
3. Mitigation: reducing the likelihood or impact of the risk through controls or preventive actions.
4. Acceptance: acknowledging the risk and choosing not to take further action.

Each treatment plan includes specific tasks that must be completed to implement the strategy effectively. Tasks may involve policy updates, control implementation, or monitoring activities to track risk status.

Mitigation and acceptance in risk treatment

1. Mitigation reduces the severity or likelihood of a risk through proactive measures. This includes implementing controls, safety procedures, or other preventive actions.
2. Acceptance applies when a risk is minimal or unavoidable. The risk is acknowledged, but no immediate action is taken.

Treatment plans should be reviewed and updated regularly to reflect changes in risk conditions.

Treatment plans and tasks

Treatment plans and tasks define strategies and specific actions for managing identified risks.

1. Treatment plans outline the approach for addressing risks.
2. Tasks specify the actions required to implement the plan, including assignments to responsible parties.

Regular monitoring and review ensure that risk mitigation efforts remain effective and adapt to changing conditions.

Assigning tasks for risk treatment

After determining the risk treatment approach, assign tasks to team members to ensure effective risk management. Each person should be responsible for specific actions that contribute to reducing the risk.

For example, to mitigate the risk of a data breach, a team member may be assigned to obtain a cyber insurance policy. This policy provides financial protection if the breach occurs.

In TrustRegister, you can create and manage treatment plan tasks directly within the platform, ensuring accountability and tracking progress for each risk.

To add tasks to the treatment plan,

1. Go to the “Action Plan” section and then to the “Treatment Plan Tasks” subsection.
2. Click on the “+” button in the right-hand side.
   The following screenshot shows how to add a task to the treatment plan.
   
   
3. Add key task details like the task name, owner, group, any notes, and a due date. You can also link an external ticket from tools like JIRA or ServiceNow to track progress. To make budget conversations easier, we recommend you add details on how much budget you are requesting as well as how much budget is allocated, so the difference can be shown to leaders.
4. Click on the “Add Task” button. Your task will be added to the treatment task list.

This task will now be visible within each risk as well as within the task page found in TrustOps. Similar to other tasks across the platform, you will receive reminders for this task via email or Slack. Click here to set up Slack or JIRA workflows for tasks. Once created, click on each row to open up the update window. Here, you will be able to change the status from ‘Open’ to ‘Resolved’ or ‘Dismissed.’ Keep in mind that updating the status will cause this task to be updated across the platform, including connected tools like Slack or Jira. In addition, you can also communicate with your team by leaving comments to track approvals or manage change.

To make changes to the task,

1. Click on the three dots in front of the task, and click on “Edit.”
2. Make changes and click on “Update Task.”
   The following screenshot shows the workflow to update a task in the treatment plan.
   
   

Risk treatment integration with Jira and ServiceNow

Risk treatment and remediation are key parts of the risk management process. To support workflows that rely on external tools, TrustRegister now allows users to link risk treatment plan tasks directly to Jira and ServiceNow. This streamlines collaboration with engineering or operations teams that track exceptions or tasks in these systems.

To learn more about TrustRegister, click here!