--- title: Risk Management in Vanta description: Risk Management in Vanta --- [Skip to content](https://knowledge.sensiba.com/risk-management-in-vanta#main-content) English Show submenu for translations - Sensiba Open main navigation Close main navigation - Sensiba - English Show submenu for translations - [Go to sensiba.com](https://sensiba.com/) [Go to sensiba.com](https://sensiba.com/) Hi There! How can we help you? - There are no suggestions because the search field is empty. 1. [Sensiba Knowledge Base](https://knowledge.sensiba.com/?hsLang=en) 2. [Platform](https://knowledge.sensiba.com/platform?hsLang=en) 3. [Vanta](https://knowledge.sensiba.com/platform?hsLang=en#vanta) # Risk Management in Vanta ## How to Complete an Annual Risk Assessment #### **Quick checklist:** - #### Scope your risks in Vanta (start with 10-20) - #### Assess inherent and residual risk ratings - #### Define treatment plans and log actions for high residual risks - #### Assign owners for accountability - #### Review your risk action tracker for feasibility - #### Share your risk assessment with auditors (enable access in Vanta) #### **Overview** Risk management is a key part of compliance, and Vanta makes it simple to scope and assess your most important risk areas. **Tip:** Start small. Including too many risks can dilute your focus. We recommend beginning with **10-20 risks** and expanding over time.   #### **Step 1: Scope Your Risks** Begin in the **Vanta Risk Library**, where you can: - Add predefined risks to your register with a click. - Add custom 'scenarios' individually or upload in bulk. **Tip:** Using Vanta's predefined risks saves time because they're already mapped to your Vanta control framework. For SOC 2 coverage, we recommend including at least one risk in these areas: - Asset management - Access control / communications security - Business continuity & disaster recovery - Fraud - Software development & acquisition - Third-party risk **Tip:** Smaller, early-stage companies can define risks at a higher level for simplicity. Larger organizations may want more granular detail. Refer to Sensiba's [example risk register](https://knowledge.assurancelab.cpa/risk-assessments) for a simplified set of risks defined at a high level for broad coverage, empowering smaller and earlier stage companies to manage risk more holistically with centralised responsibility.  #### **Step 2: Assess Risk Ratings** For each risk in your register: - Rate **inherent likelihood and impact**. - Define a **treatment plan**. - Rate **residual likelihood and impact** after controls. - Map mitigating controls and log any future actions.T**ip:** If residual risk is **6 or higher**, log an action for improvement. Assign an owner for accountability and ongoing management. Remember: The goal is **continuous risk reduction**. Most treatment plans will aim to mitigate risks. Acknowledging material residual risks does **not** compromise compliance. #### **Step 3: Track Actions & Monitor** Review your **risk action tracker** to confirm tasks are realistic and timeframes achievable. - For **Type 1 audits**, your risk register and action plans demonstrate effective design. - For **Type 2 audits**, auditors look for evidence of ongoing improvements and monitoring. **Tip:** Auditors want to see a system that identifies, assesses, treats, and monitors risks continuously. The ratings and actions are up to management to determine what's appropriate. #### **Step 4: Sharing Your Risk Assessment with Auditors** Once your risk register or manual risk assessment is ready, please enable auditor access in Vanta so we can review your documentation. **How to share:** https://help.vanta.com/en/articles/11345504-creating-a-risk-snapshot  #### **Need Help?** We're here for you! If you have questions or something feels unclear, reach out anytime at [csplatform@sensiba.com](mailto:csplatform@sensiba.com)    - [Platform](https://knowledge.sensiba.com/platform?hsLang=en#main-content) - [Vanta](https://knowledge.sensiba.com/platform?hsLang=en#vanta) - [Drata](https://knowledge.sensiba.com/platform?hsLang=en#drata) - [Scrut](https://knowledge.sensiba.com/platform?hsLang=en#scrut) - [Sprinto](https://knowledge.sensiba.com/platform?hsLang=en#sprinto) - [Best Practices Series](https://knowledge.sensiba.com/best-practices-series?hsLang=en#main-content) - [Risk management & internal controls](https://knowledge.sensiba.com/best-practices-series?hsLang=en#risk-management-internal-controls) - [Information & communication](https://knowledge.sensiba.com/best-practices-series?hsLang=en#information-communication) - [Data protection](https://knowledge.sensiba.com/best-practices-series?hsLang=en#data-protection) - [System security](https://knowledge.sensiba.com/best-practices-series?hsLang=en#system-security) - [Change management](https://knowledge.sensiba.com/best-practices-series?hsLang=en#change-management) - [System operations](https://knowledge.sensiba.com/best-practices-series?hsLang=en#system-operations) - [Control environment](https://knowledge.sensiba.com/best-practices-series?hsLang=en#control-environment) - [Consumer Data Right Guides](https://knowledge.sensiba.com/consumer-data-right-guides?hsLang=en#main-content) - [Network Security](https://knowledge.sensiba.com/consumer-data-right-guides?hsLang=en#network-security) - [Vulnerability Management](https://knowledge.sensiba.com/consumer-data-right-guides?hsLang=en#vulnerability-management) - [Security Awareness](https://knowledge.sensiba.com/consumer-data-right-guides?hsLang=en#security-awareness) - [Anti-malware](https://knowledge.sensiba.com/consumer-data-right-guides?hsLang=en#anti-malware) - [Information Asset Lifecycle](https://knowledge.sensiba.com/consumer-data-right-guides?hsLang=en#information-asset-lifecycle) - [Access Control](https://knowledge.sensiba.com/consumer-data-right-guides?hsLang=en#access-control) - [Governance Requirements](https://knowledge.sensiba.com/consumer-data-right-guides?hsLang=en#governance-requirements) - [ISO 27001](https://knowledge.sensiba.com/iso-27001?hsLang=en) - [Control Environment](https://knowledge.sensiba.com/control-environment?hsLang=en) - [Information and Communication](https://knowledge.sensiba.com/information-and-communication?hsLang=en) - [Risk Management](https://knowledge.sensiba.com/risk-management?hsLang=en) - [Vendor Management](https://knowledge.sensiba.com/vendor-management?hsLang=en) - [System Security](https://knowledge.sensiba.com/system-security?hsLang=en) - [System Operations](https://knowledge.sensiba.com/system-operations?hsLang=en) - [Change Management](https://knowledge.sensiba.com/change-management?hsLang=en) - [Confidentiality](https://knowledge.sensiba.com/confidentiality?hsLang=en) - [Privacy](https://knowledge.sensiba.com/privacy?hsLang=en) - [CDR Reps](https://knowledge.sensiba.com/cdr-reps?hsLang=en) - [Access reviews](https://knowledge.sensiba.com/access-reviews?hsLang=en) - [Governance](https://knowledge.sensiba.com/governance?hsLang=en) - [Employee management](https://knowledge.sensiba.com/employee-management?hsLang=en) - [FAQs](https://knowledge.sensiba.com/faqs?hsLang=en) - [Sensiba Audit Tools](https://knowledge.sensiba.com/sensiba-audit-tools?hsLang=en) - Sensiba [![Sensiba Logo](https://knowledge.sensiba.com/hs-fs/hubfs/Sensiba_Logo_Hubspot-01.png?width=247&height=48&name=Sensiba_Logo_Hubspot-01.png "Sensiba Logo")](https://sensiba.com/) Copyright © 2026, Sensiba LLP