Treatment plans that are approved, not assumed.
Choose how a risk becomes Active, such as the Risk Team defining the plan or the Action Owner defining it for Risk Owner and CISO approval. Every plan is versioned, every decision is recorded and segregation of duties is enforced.
Owner notified by email · Due in 5 days · Full history retained for audit.
3 gaps identified; 2 map to existing risks, 1 proposed as a new finding. Approve or reject each before accepting.
Illustration with sample data
What Risk Treatment Workflows & Approvals does
Every new risk starts as a Draft and becomes Active only through the workflow your organisation chose. Workflow 1 lets the Risk Team define and submit the plan. Workflow 2 has the Action Owner define the plan, the Risk Owner approve or return it with a reason, and the CISO give final approval for Critical, High and Medium risks. Workflow 3 lets the Security Team route each approval to the Risk Owner, the CISO or both, and a Critical risk always includes the CISO. You can set a company default and override it per organisation.
Each submitted plan is kept as a numbered version with its tasks, decisions and comments. A change to an approved plan needs approval again. Approvers see an AI decision brief written only from the record's facts, and it never recommends a decision. Approvers can decide in the Action Center or from an email, after signing in. Before a Critical, High or Medium risk closes, an independent reviewer confirms that the treatment was effective. Risk acceptance requires compensating controls, Risk Owner and CISO approval, and an expiry date.
Key capabilities
Three workflows
Risk Team defines; Action Owner defines and Risk Owner (+ CISO) approves; or the Security Team routes the approval.
Versioned plans
Every submission is an immutable version with its tasks, decisions and comments.
Re-approval on change
Changing an approved plan sends it back for approval; reassigning a task does not.
AI decision briefs
Approvers get a short factual summary built from the record, which never recommends a decision.
Effectiveness review
An independent reviewer confirms treatment worked before a Critical, High or Medium risk can close.
Governed risk acceptance
Compensating controls, Risk Owner then CISO approval, and an expiry or review date on every acceptance.
The business case.
Efficiency, multi-framework alignment, reduced complexity and streamlined processes: what Risk Treatment Workflows & Approvals changes for your programme.
Less approval chasing
Queues, reminders, decision briefs and approvals from email replace follow-up emails and meetings.
Enforced, not documented
The Risk Owner and Action Owner are different people, and submitters never approve their own plans.
Approved means approved
Any change to an approved plan returns it for approval, with the earlier version kept.
Per organisation
Each business unit can run the workflow that fits it, and every risk keeps the workflow it started with.
Efficiency figures compare the effort of each workflow cycle in RiskVantis with the same work done manually or in a traditional GRC tool. Your result depends on your starting point; we will model it with you in a demo.
From setup to outcome.
Draft
The risk starts as a Draft and is assigned to the workflow of its organisation.
Define the plan
The Risk Team or the Action Owner defines tasks, with optional AI suggestions.
Approve
The Risk Owner and/or CISO decide, with a decision brief, in-app or from email.
Activate and verify
The risk becomes Active; effectiveness is reviewed before closure.
Supports your obligations.
Risk Treatment Workflows & Approvals contributes evidence and coverage to these frameworks and regulations.
Common questions.
Can different business units use different workflows?
Yes. Set a company default and override it per organisation. A risk keeps the workflow it was created under even if the setting later changes.
Can approvers decide from email?
Yes, for treatment plans, risk acceptances, risk exceptions and finding remediation plans. The email button opens the decision after sign-in, and the decision runs exactly as in the app.
Does the AI recommend approval?
No. The decision brief summarises facts gathered with the approver's own access and never recommends a decision.
Works better together.
Risk Register & Intake
Every risk is captured the same way, scored by one engine, mapped to the controls it threatens and tracked through eight visible stages, with a history nobody can…
Learn more →Platform, Security & IntegrationsAction Center & Email Approvals
Focus brings every approval, plan, task, evidence request and due date from every module into one list, ordered by urgency. Act inline, or straight from an email after…
Learn more →Risk ManagementRisk Exceptions
A structured exception process with justification, compensating controls, remediation plans, two-level approval and time-boxed expiry, so every accepted risk has an…
Learn more →See Risk Treatment Workflows & Approvals in action.
Book a 30-minute walkthrough tailored to your frameworks, vendors and team.