✅ Feature availability: A single risk register is included with Core Risk Management. Multiple risk registers, enterprise risks, and risk customization require Advanced Risk Management. Refer to Vanta Plans and Pricing for details.

Use the Risks page to add risk scenarios, organize them into risk registers, and keep them up to date as your risks change. You can also group related scenarios under enterprise risks and customize fields, categories, and scoring to fit how your organization tracks risk.

⚙️ User permissions: Editors and Admins can manage all risk registers, scenarios, and settings. Collaborators can be given access to risk registers or individual risk scenarios. Risk Scenario Owners, Risk Scenario Managers, and Risk Register Managers can archive, restore, and delete risks they have access to, but they can’t delete risk registers. Learn more: User Permissions by Product Area

Risks page

Start by setting your risk register and risk settings, then adding and managing risk scenarios within it. If needed, you can later group related scenarios under enterprise risks for a more strategic view. Risks Management is built around three core objects:

Object	Description	Feature availability
Risk register	A folder that organizes your risk scenarios. You can use registers to group risks by team, product, or business unit and control who has access.	Single risk register with Core Risk Management, multiple risk registers with Advanced Risk Management
Risk scenario	A specific potential risk to your organization. This is the core unit of work—you’ll assess, track, and manage risk at the scenario level.	Available on all plans
Enterprise risk	A higher-level risk that groups related scenarios across registers, helping you connect team-level risks to broader organizational impact.	Available with Advanced Risk Management

From the Risks page, you can search and filter the risk scenarios in a risk register. Filter risks by fields like owner, status, and overall risk scores. Customize your table view using the controls icon to choose which columns to display and adjust how data is shown.

Risk registers

A risk register is a folder that contains your risk scenarios. You can use registers to group risks and control who can view or edit them. Depending on your plan, you might only have a single default register, or you may be able to create multiple registers to organize your risks.

💡 Tip: If you plan to import risks in bulk, set up your registers first so you can map each risk to the correct register during import.

Adding registers

If your account has access to create multiple risk registers, a register is created automatically with the name Default. New risks are added to this register unless you create additional registers. You can rename the default register at any time.

Create additional risk registers to organize risk scenarios based on how your program is structured—for example, by team, product, location, or risk domain.

To add a risk register:

On the Risks page, click the Add button.
Select Add register.
Enter a Name and Description for the register.
Click Add.
Manage access to control who can view or edit the risks in each register.

Editing or deleting registers

To edit a register’s name, description, or other settings, click the ••• menu and select Register settings.
To delete a register, click the ••• menu and select Delete register.

⚠️ Note: Deleting a register permanently deletes all risk scenarios within it. Move risk scenarios you want to keep to another register before deleting.

Managing register access

If your account has access to create multiple risk registers, you can control who can access each set of risks. Use register access to ensure the right people can view or manage risks while keeping sensitive information restricted.

To grant access to a risk register:

On the Risks page, click the ••• menu next to the risk register.
Select Manage access.
Add a user and assign their access level:
- Viewer: Can view risks in the register.
- Manager: Can view, add, and edit risks in the register.

You can also manage access by clicking the share icon within the risk register.

ℹ️ Note: Users need to granted the proper user permissions before they can be added to a register. Learn more

Moving risks between registers

To move risks to another register:

From the Risks page, open the risk register that contains the risks you want to move.
Select the checkbox next to each risk scenario you want to move.
In the toolbar, click Move to register.
In the Register dropdown, select the register you want to move the risks to.
Click Move.

Exporting a risk register

To export a risk register:

From the Risks page, open the risk register you want to export.
Click the ••• menu at the top of the register.
Select Export all risk scenarios (.csv).

Risk scenarios

A risk scenario is a specific potential risk to your organization and the core unit you’ll assess, track, and manage. Add risk scenarios to a risk register or import them in bulk. Assign an owner to each scenario to give them access to complete risk assessments.

Adding a risk

To manually add a risk:

From the Risks page, open a risk register.
Click the Add button.
Enter a Description for the risk scenario.
If you’re using multiple risk registers, select the register to add the risk to.
If you use your own ID convention, add a Risk ID. Otherwise, leave it blank and we’ll generate one for you.
Click Add.

💡 Tip: You can also add risks via API or using our MCP.

Using the risk library

Vanta’s risk library includes common risk scenarios you can use to quickly build your risk inventory. You can choose whether to automatically add recommended controls to each risk so they map to your frameworks.

To edit your risk preferences:

In your account header, click the Settings icon.
In the page menu, scroll to the Features section and select Risk.
Go to the Preferences section.
Choose between:
- Always add recommended controls
- Ask me every time if I want to add recommended controls
- Never add recommended controls

To add risks from the risk library:

Go to the Risk library page.
Browse the available risk scenarios.
Click Add to register on a risk you want to use.
If you’re using multiple risk registers, select the register to add the risk to.

ℹ️ Note: To add the same risk to multiple registers, you’ll need to add the risk twice—once to each register.

Importing a spreadsheet

Import risk scenarios in bulk using a spreadsheet. Before importing, make sure any custom fields you want to include are already set up in your risk settings.

To import risks from a spreadsheet:

From the Risks page, open a risk register.
Click the Add button and select Import.
Review the instructions on the import page, download the CSV template, and prepare your file.
Upload a CSV file with your risk details. The only required column is Risk Scenario.
Map your spreadsheet columns to the corresponding fields in Vanta, then click Next.
Review your import, especially rows with issues, then click Import.

💡 Tip: You can export risks, make updates in a spreadsheet, and upload a file to bulk update existing risks using Risk ID. Before re-uploading, make sure the spreadsheet matches Vanta’s import template.

Managing risk access

Each risk scenario has two roles you can assign:

Risk Scenario Owner: Edit access to the risk scenario so they can complete assessments.
Risk Scenario Manager: Edit access to the risk scenario and can manage who has access to the risk scenario.

To manage access:

To assign an owner to a single risk scenario, click the Owner field in the risk register or in the risk scenario header.
To assign owners in bulk, select multiple risk scenarios in the risk register, then click Assign Owner from the toolbar.
To add manager, click the ••• menu next to the risk.

ℹ️ Note: Users need to granted the proper user permissions before they can be added to a risk. Learn more

Updating risks and risk assessments

Keep risk scenarios up to date by completing risk assessments to ensure risk details, risk mappings, risk scores, and treatment plans are properly documented and approved.

📖 Learn more: Completing Risk Assessments

Archiving risks

Archive risk scenarios you no longer need to track. Archiving removes a risk from your active register and from future snapshots. You can restore archived risks or delete them later.

To archive risks:

From the Risks page, open a risk register.
- To archive one risk: Click the ••• menu next to the risk and select Archive.
- To archive in bulk: Select the risks and click Archive all in the toolbar.

To view archived risks:

From the Risks page, open a risk register.
Click the ••• menu at the top of the page.
Select View archived risk scenarios.

To restore an archived risk:

On the archived risks page, click the ••• menu next to the risk.
Select Restore.

Deleting risks

Delete a risk scenario to remove it permanently. To delete an individual risk, you need to archive it first.

To delete risks:

From the Risks page, open a risk register.
Click the ••• menu at the top of the page.
Select View archived risk scenarios.
On the archived risks page
- To delete one risk: Click the ••• menu next to the risk and select Delete.
- To delete in bulk: Select the risks and click Delete all in the toolbar.

⚠️ Note: Deleting a risk scenario permanently deletes all risk details, assessment history, and associated tasks.

Enterprise risks

Enterprise risks are higher-level risk scenarios used to group related risks. They work the same way as risk scenarios, but live in a separate risk register and represent broader, cross-team visibility.

Use enterprise risks when you want to organize related risks or report on risk at a higher level across your organization:

Enterprise risks act as a parent to group related risk scenarios.
An enterprise risk links to multiple risk scenarios.
An individual risk scenario can be linked to one enterprise risk.
Enterprise risks use the same fields, assessments, and workflows as risk scenarios.
Only Admins and Editors can view, manage, own, or approve enterprise risks.

Risk customization

Customize the fields your team will use to define and evaluate risk scenarios. This includes adding categories and metadata to capture the right context, and aligning your scoring rubric with how your organization assesses risk. Setting this up early ensures your risk data is consistent, meaningful, and ready to support assessments and reporting.

Adding custom fields

Custom fields let you capture additional details for your risk scenarios beyond the default fields. Once added, these fields appear when editing a risk scenario so your team can consistently track the information that matters most.

You can apply custom fields to all registers or limit them to specific registers. When you add a risk register, it inherits all custom risk fields by default. Enterprise risks include all custom fields by default since they map across registers.

To add custom fields:

In your account header, click the Settings icon.
In the page menu, scroll to the Features section and select Risk.
Scroll to Custom fields and click Add.
Enter a Field label and Description.
Select a Data type: Currency, Date, Number, Multi-select, Text, or User. You can’t change the data type after creating the field.
Choose the risk registers the field applies to.

To edit custom fields per risk register:

Use the dropdown menu to select a risk register.
Click the ••• menu next to a field to update which registers it applies to.
Drag and drop fields to reorder them.

Adding custom categories

Custom categories let you label and group risk scenarios based on your organization’s needs. Once added, categories are available as a selectable field when editing a risk scenario, making it easier to classify and filter risks.

To add custom categories:

In your account header, click the Settings icon.
In the page menu, scroll to the Features section and select Risk.
Scroll to the Custom categories section.
Click Add and enter a category name.
Click Add category.

Customizing risk scoring

Depending on your plan, you can customize your risk scoring to reflect how your organization evaluates risk.

Configuring auditor view

Choose whether auditors can view your live risk registers or only the risk snapshots you share with them. This is one account-wide setting. It isn’t limited to a single audit or framework, so when it’s on, auditors from any of your audits can see all your risk registers.

To manage the auditor view setting:

Go to Settings.
In the page menu, scroll to the Features section and select Risk.
In the General tab, go to the Preferences section.
Enable or disable the Configure auditor view setting.

Configure auditor view	What auditors can see
Disabled	Only the risk snapshots you explicitly shared with them. They can’t open your risk registers or see archived risks.
Enabled	Any risk snapshots you shared with them, plus view-only access to all risk registers, action trackers, and archived risks.

ℹ️ Note: Archived risks are excluded from future snapshots, risk assessment reports, and risk reports, but they stay in your risk register. If auditor view is on, auditors can open the archived risks page in read-only mode. To keep a risk out of an auditor’s view, delete it. Deleting is permanent and removes the risk from your register entirely.

Managing Risks and Risk Registers