# How it Works

This article explains how Sprinto enables organisations to register, assess, treat, and monitor risks to meet security compliance requirements.

### Step 1: Register Risks

You can add risks in Sprinto using any of the following methods:

* **Sprinto Risk Library**: Choose from a curated list of industry-standard risks.
* **Manual Registration**: Define custom risks tailored to your organisation.
* **Bulk Upload**: Use the CSV upload option to import multiple risks at once.

Each risk includes detailed metadata such as risk category, owner, source, CIA classification, and scoring parameters.

> ⚠️ Risks added through bulk upload or manual entry must undergo scoring to become complete.

### Step 2: Score Risks

For each registered risk, enter the following parameters:

* **Likelihood**: Probability of occurrence before mitigation.
* **Impact**: Severity if the risk occurs.
* **Residual Likelihood & Impact**: Values after mitigation.

Sprinto calculates both **inherent risk** and **residual risk** scores based on these parameters. The risk remains in **Incomplete** status until this step is completed.

### Step 3: Map Controls

Controls are mitigation measures mapped to each risk. You can:

* Manually select controls relevant to your risk.
* Use **Sprinto AI** to get smart control suggestions.

Controls are mapped to compliance frameworks like SOC 2, ISO 27001, or GDPR.

> 💡 You can review each control’s applicability and associated framework before mapping.

### Step 4: Define Treatment Plan

Each risk requires a treatment approach:

* **Accept**: Acknowledge the risk and accept its residual score.
* **Transfer**: Shift risk responsibility (e.g. outsourcing, insurance).
* **Further Mitigate**: Plan additional actions to lower the residual score.
* **Avoid**: Eliminate the risk by discontinuing related activities.

Sprinto lets you assign a treatment reason and add optional notes.

### Step 5: Create Treatment Tasks

For risks that require action, you can create **Risk Treatment Tasks**:

* Assign tasks to Security Hub admins.
* Set due dates and descriptions.
* Attach evidence or add notes.

Once a task is marked complete, its status updates to **Passing**.

### Step 6: Perform Risk Assessment

Risk assessments must be conducted periodically (at least once a year). You can:

* **Assess in-app** using the risk register.
* **Upload assessment reports** from external systems.

During the assessment:

* Review each risk’s parameters.
* Register new risks if needed.
* Update control mappings and treatment plans.

### Step 7: Review by Senior Management

Once the risk assessment is completed, senior management must review it:

* Access the pending review card under **Security Hub > Review**.
* Review all risks and assessment details.
* Acknowledge the assessment to complete the process.

This sets the risk assessment system check to **Passing**.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.sprinto.com/risks/how-it-works.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.