Treatment Workflows

Flow provides structured treatment workflows that guide risk owners through selecting, documenting, and tracking risk treatment strategies. Treatment decisions directly influence residual risk scores and drive action creation for mitigation activities.

Overview

Treatment workflows in Flow support:

• Four Treatment Strategies - Accept, Mitigate, Transfer, and Avoid
• Rationale Documentation - Capture the reasoning behind each treatment decision
• Residual Risk Assessment - Reassess likelihood and impact after treatment
• Effectiveness Tracking - Measure how treatments reduce risk over time
• Action Generation - Automatically create mitigation actions from treatment plans

Treatment Strategies

Accept

• When to Use - Risk falls within the organization's risk appetite
• Required Documentation - Justification for accepting the risk, approving authority
• Effect - Inherent score remains unchanged; risk is monitored but not actively mitigated
• Review - Accepted risks should be reviewed at the configured cadence to confirm continued acceptability

Mitigate

• When to Use - Risk exceeds appetite and can be reduced through controls or actions
• Required Documentation - Mitigation plan, target residual score, responsible parties
• Effect - Residual likelihood and/or impact are reduced through implemented controls
• Actions - Create specific mitigation actions with owners, due dates, and success criteria

Transfer

• When to Use - Risk can be shifted to a third party (insurance, outsourcing, contracts)
• Required Documentation - Transfer mechanism, third party details, residual exposure
• Effect - Impact is partially or fully transferred; residual risk reflects remaining exposure
• Considerations - Transferred risks still require monitoring for counterparty risk

Avoid

• When to Use - Risk is unacceptable and the triggering activity can be eliminated
• Required Documentation - Business justification, alternative approaches, stakeholder approval
• Effect - Risk is closed or significantly reduced by eliminating the risk source
• Trade-offs - Document any business opportunities foregone by avoiding the risk

Treatment Workflow Steps

1. Initial Assessment

When creating or editing a risk, assess the inherent likelihood and impact to calculate the inherent risk score. This represents the risk level before any treatment is applied.

2. Treatment Selection

Select the appropriate treatment strategy from the risk form. The treatment dropdown presents all four options with contextual guidance.

3. Rationale Documentation

Provide a written rationale explaining why the selected treatment is appropriate. This creates an auditable record of the decision-making process.

4. Residual Assessment

For Mitigate and Transfer strategies, reassess the likelihood and impact with the treatment in place. The residual score reflects the expected risk level after treatment.

5. Action Creation

For Mitigate treatments, create specific actions linked to the risk. Each action should have:

• A clear description of the mitigation activity
• An assigned owner responsible for execution
• A target completion date
• Success criteria for verification

6. Effectiveness Monitoring

The Treatment Effectiveness chart on the analytics dashboard tracks:

• Average Inherent Score per treatment type
• Average Residual Score per treatment type
• Risk Reduction Percentage showing the effectiveness of each treatment strategy
• Treatment Distribution across your risk portfolio

Treatment Effectiveness Analytics

Flow automatically calculates treatment effectiveness metrics:

• Risk Reduction - Percentage decrease from inherent to residual score
• Treatment Distribution - Breakdown of risks by treatment strategy
• Trend Analysis - How treatment effectiveness changes over time
• Comparison - Side-by-side effectiveness across treatment strategies

Best Practices

• Document Thoroughly - Every treatment decision should have a clear rationale
• Set Realistic Residuals - Residual scores should reflect achievable outcomes, not aspirations
• Link Actions - Every Mitigate treatment should have at least one corresponding action
• Review Regularly - Treatment effectiveness should be reassessed at each review cycle
• Escalate Appropriately - Accept and Avoid decisions should be approved at the appropriate management level