Risk Manager User Guide
SoftComply Risk Manager was recently migrated from Connect to Forge.
Following its migration from Connect to Forge, SoftComply Risk Manager shares the same interface and underlying logic as Risk Manager Plus, with the feature differences outlined below:
Risk Models – these are customizable risk assessment models, basis of your risk scoring. In the SoftComply Risk Manager, users can only create 2-dimensional risk matrices. In the Risk Manager Plus, users can also create 3-dimensional risk matrices and Risk Score based models. The latter also support various options for risk value calculations like Maximum and Average, among many others. In the Risk Manager Plus users can also build nested models, i.e. child risk assessment model (e.g. 5 levels of impact) and its parent risk model (e.g. overall impact derived from the child model x likelihood). In both apps, users can add several iterations (risk assessments) and levels for risk characteristics/parameters, configure the risk classes and levels including names, colours and values.
Risk Tables – this is the name for Risk Registers in SoftComply Risk Manager apps. In the Risk Manager Plus, users can create multiple sheets to their risk tables, and assign different risk models to each sheet if needed. In the Risk Manager app, users can only create 1-sheet risk tables (risk registers).
Object Registers – these are data libraries for risk related data that are repeatedly being used across projects and across your organization. In the Risk Manager Plus, users can create and customize object registers for various data libraries like their information assets, risk controls, hazards and many more. Users can search, filter, sort, and build traceability matrices between different objects and risks in the Risk Dashboard of the Risk Manager Plus. In the Risk Manager app, users cannot create Object Registers. Only in cases where users had Harm-Severity lock in the previous version (until October 2026) of the Risk Manager, will they be able to see a “Harms” Object Register that shows their previously created Harm-Severity pairs.
Templates Library – this provides a set of risk model, risk table and object register templates for various risk management frameworks. Templates library is available only to the Risk Manager Plus users.
SoftComply Risk Manager vs Risk Manager Plus Feature Comparison
Feature | SoftComply Risk Manager | SoftComply Risk Manager Plus |
|---|---|---|
2-dimensional risk matrices | Supported | Supported |
3-dimensional risk matrices | Not available | Supported |
Risk Score based models | Not available | Supported, with various risk value calculation options, including Maximum, Average, etc. |
Nested risk models | Not available | Supported |
Risk model customisation | Multiple assessment iterations; configurable risk characteristic/parameter levels; customisable risk classes, including names, colours and values. | Multiple assessment iterations; configurable risk characteristic/parameter levels; customisable risk classes/levels, including names, colours and values. |
Risk Tables (risk registers) | One sheet per risk table. | Multiple sheets per risk table, with the option to assign a different risk model to each sheet. |
Object Registers | Not available * | Supported. |
Object search and traceability matrix | Not available. Traceability matrix supports only risks and other Jira issues, not objects from object registers. | Supported. |
Templates Library | Not available | Supported. |
* Legacy Harm–Severity data: Risk Manager users who used the Harm–Severity lock before October 2026, can view their previously created Harm–Severity pairs in a Harms Object Register. This exception does not enable the creation of new object registers.
1. QUICK GUIDE TO THE RISK MANAGER
Open (or create) a Jira Space in which you want to manage your risks.
Find the “Risk Management“ tab from the menu. If it is not there, go to Space settings → Apps → Risk Management Settings and “Enable Risk Management” for this Jira space.
Next, click on the “Risk Models“ menu in the Risk Management Settings and Enable a risk assessment model for your Space, choosing from the list of available Risk Models.
Next, you will be guided by the tool to choose a Risk Table (Risk Register) from the list of table templates to manage your risks.
2. SET UP YOUR RISK PROJECT
2.1. RISK MODEL and Customization
A Risk Model determines the way you assess the risks – the number of risk characteristics you need and the risk evaluation method that you use. You can create your own Risk Models from scratch, just follow the guided Create Model configuration. The existing Risk Model Templates can be fully configured, following the steps below:
Go to “Apps” → “Risk Manager” → “Risk Models” page to create your own risk models or to edit any of the existing Risk Model Templates provided.
All Risk Model attributes are customisable, i.e. you can add and name your own Risk Characteristics (classifiers like Probability, Impact, Detectability, etc), define Risk Classes, Risk Assessment Iterations (steps like Initial, Current, Target, etc).
Risk Models are all global templates for your team(s) working in your Jira instance and they can be used in any of the Jira projects in which you manage risks.
Define your own Risk Model or choose one from the templates:
Define the number and names for your Risk Iterations following the wizard:
Unlimited configurability of risk models:
You can have many risk assessment models in one Jira project.
You can assess one risk (Jira work items) in different ways (multiple risk models assigned to risks).
You can use different risk models for different risks (Jira work items) inside one Jira project.
2.2. RISK TABLE and Customization
A Risk Table provides you with an overview of your risks in a familiar spreadsheet format – you can work on your risks either in this Risk Table view or in a Jira issue view one risk at a time, as each risk is an individual Jira issue. A Risk Table in the SoftComply Risk Manager has one sheets while the Risk Manager Plus app support several to best organise your risks. You can define and name your Table sheet yourself. You can create your own Risk Table from scratch or you may customise the existing Risk Table templates provided:
Go to “Apps” → “Risk Manager” → “Risk Tables” page to create your own Risk Table or edit any of the existing Risk Table Templates provided;
You can define table columns as you would in Excel;
Next, connect your Risk Table with a Risk Model and assign the Jira fields (column types) to your table columns for additional information about your risks.
2.3. OBJECT REGISTERS and Customization
harms are linked to your severity levels of risks. In Risk Manager Plus you can also create new object registers, i.e. custom data structures (i.e. data tables) and link these structures to Jira work items like you would link other issues. Custom data structures are like database tables that you can build inside the Risk Manager Plus application. When these registers are filled with data you can link Jira issues with data objects. In other words, the registers are like complex customisable dropdown lists you can use as Jira issue fields. There are many benefits of using Object Registers and its data, e.g. in ISO27001 there are IT risk controls. Each Control object has: Reference to ISO standard, Clause, Objective and Control description. You can list all of them to one dedicated register and reuse them in multiple risk projects. Same applies to the Hazards in ISO14971 risk management. Each Hazard can consist of Title, Group and other data fields.
Object Registers are not available in the Risk Manager app. The only exception to this rule are users who had previously built Harm-Severity pairs in the Risk Manager app prior to its migration to Forge, before October 2026. These users can check their Harm and Severity pairs in the pre-populated Harms register, but they cannot create any new objects or registers themselves.
2.4. ASSESSING RISKS in Risk Table & Jira Issue View
Once your risk project, risk model, risk table and object registers are set up you are ready to start creating and assessing your risks. You can do that directly inside the Risk Table view by using the “create” button and setting the risk values in the corresponding table cells:
Alternatively, you can enable Risk Panels in Jira issue view and assess your risks directly inside the Jira issue view:
3. RISK DASHBOARD
Risk Dashboard includes the overview of your Risks in a specific project and you can also set up the Traceability pairs that will start automatically building while you are working with your Risks.
First the Dashboard needs to be set up. Start by going to the Dashboard view in the Risk Manager app and click on the Configure Dashboard button.
You can also set up (and later change, if needed) the Dashboard in the Settings. Go to Risk Manager > Settings > Risk Dashboard and select a Risk Management Project.
You can define the items and create the Traceability Pairs between the items. In the Risk Manager, the traceability pairs can be set up only between different Jira issues.
Once the Traceability Pairs have defined, you will be able to see your progress on the Risk Dashboard.
4. RISK REPORTS
From the project, you can export the Risk Model and Risk Table reports.
Risk Model can be exported as PDF:
Risk Table can be exported as PDF or into CSV format:
You can also get reports across different projects that use the same Risk Model (aggregated Risk Model Report):
Go to Apps > Risk Manager > Risk Models
Click on the Report icon behind the specific Risk Model
Choose the projects where the chosen Risk Model is used to be included in the overall risk report:
Once the report is generated, you can view the statuses of all risks across the selected Jira projects that use this specific Risk Model.
Confluence Reporting
There is a free extension of SoftComply Risk Manager apps for reporting risks on Confluence Cloud. Read more at https://softcomply.com/product/risk-confluence/
5. PERMISSIONS
5.1. Risk Manager Admin
Risk Manager has one special role – Risk Management Administrator. All Jira Administrators are Risk Management Administrators by default and you can assign this role to the users/groups under “Apps” → “Risk Manager” → “Settings“ → “Permissions“. Risk Management Administrators can:
add/edit/remove Risk Model and Risk Table global templates;
assign Risk Model and Risk Tables to Jira Project.
Regular Jira users can work with the Risk Manager tool using the global templates created for them and provided that risk management is enabled in the project that they have access to.
6. SPACE SETTINGS FOR RISK MANAGEMENT
6.1. Accessing RISK MANAGEMENT SETTINGS
To Access Risk Management Settings, open the “More Actions” panel, click “Space settings”, then open the “Apps” section to access Risk Management Settings.
Next, enable Risk Management in the selected space by clicking the “Enable Risk Management“ button.
6.2. QUICK FILTERS setting
After enabling Risk Management, the “Quick filters” view appears.
The app creates two default filters available on the space’s Risk Table and Risk Model views to filter work items.
These default quick filters can be applied from your Jira space’s Risk Model view:
Note that the filter name must be filled, it cannot exceed 100 characters (it is cropped automatically) and requires a JQL query with an operator and value. Hover over the “!” icon to see the error message.
In case the JQL query is wrong, you will be notified of it and can check out more when hovering over the “!” icon.
To remove a quick filter, click on the bin icon at the end of the row. A confirmation message will appear, and you must confirm the deletion to remove the filter.
When all quick filters are removed, the table will be empty.
You can create up to 25 quick filters. When this number of filters has been reached, the “Add Filter” button will disappear.
6.3. Managing RISK MODEL SETTINGS
After enabling Risk Management to your Jira space, assign risk models to the space in the “Risk models“ tab of the Settings.
Click “Add Risk Model“ to link risk models. You can link up to 10 models per space.
When adding an 11th risk model to the Jira space, a notification message is shown and the “Assign“ button is disabled.
Assigned risk models appear as a list in the left menu. Each model’s name, type and risk classes are displayed.
Clicking on a risk model shows a detailed view of the risk model with quick filters on the right.
Clicking on the three dots after the model’s name opens an actions menu with two options: edit and remove. The “Edit” button opens a new tab with the selected model’s edit view.
The “Remove” button opens a confirmation message. Clicking “Yes” removes the risk model only from that specific Jira space. After removal, the model will no longer appear in the space or work item views.
6.4. Adding RISK MODEL-SPECIFIC FILTERS
Each risk model can have its own filters – work item type or JQL (opens from “Advanced“ link) – that display only selected item types in the risk model view. Only these work items will then have the risk values panel available for risk assessment in the work item view.
Users can select work item types from the “Select work item” dropdown, which lists all available types. Multiple types can be selected.
Users can select more than one work item type that will be treated as risk in this specific Jira space.
Switching to the “Advanced” filter pre-fills the JQL field with the selected work item types, which the user can replace.
JQL filter is automatically validated. An error message appears (hover on the “!“) when incorrect JQL is added.
6.5. Managing RISK TABLE SETTINGS
After enabling Risk Management, you can link a Risk Table to your Jira space from the “Risk tables“ tab by clicking the “Add Risk Table“ button. The risk table sheet, columns and assigned risk model appear.
Only one risk table can be linked per Jira space. The “Add …” button disappears after assigning a risk table.
Click on the table name to open the risk table edit view in a new tab.
If you want to choose another Risk Table for the space, click on the three dots to access the “Replace” button. Clicking on it opens the “Assign Risk Table to Project” modal, where the user can select another table. The selected risk table then appears in the settings risk tables view.
Users can remove the risk table by clicking on the three dots and selecting “Remove.” A confirmation message appears. After removal, the view shows a message stating no risk table is assigned and an “Assign Risk Table” button.
When a Risk Table links to a Risk Model that is not assigned to that Jira space, a warning appears after the Risk Model’s name.
6.6. DISABLING Risk Management
To disable risk management in a specific Jira space, click on the “Disable risk management” button at the top of the Space settings view. Disabling does not remove linked risk models or risk table, but hides the risk management button from the space top menu and work item view. Re-enabling risk management restores the view of the linked risk models and risk table in the space top menu bar as well as the work item view.
7. BOOK A DEMO
To learn more about the SoftComply Risk Manager on Jira Cloud, or about upgrading to Risk Manager Plus, you are most welcome to book a DEMO CALL with the SoftComply team.
