✅ Feature availability: A single risk register is included with Core Risk Management. Multiple risk registers, enterprise risks, and risk customization require Advanced Risk Management. Refer to Vanta Plans and Pricing for details.

Use the Risks page to add risk scenarios, organize them into risk registers, and keep them up to date as your risks change. You can also group related scenarios under enterprise risks and customize fields, categories, and scoring to fit how your organization tracks risk.

⚙️ User permissions: Admins and Editors can manage all risk registers and risk scenarios. Collaborators can be given access to risk registers or individual risk scenarios. Learn more: User Permissions by Product Area

Risks page

Start by setting your risk register and risk settings, then adding and managing risk scenarios within it. If needed, you can later group related scenarios under enterprise risks for a more strategic view. Risks Management is built around three core objects:

Object	Description	Feature availability
Risk register	A folder that organizes your risk scenarios. You can use registers to group risks by team, product, or business unit and control who has access.	Single risk register with Core Risk Management, multiple risk registers with Advanced Risk Management
Risk scenario	A specific potential risk to your organization. This is the core unit of work—you’ll assess, track, and manage risk at the scenario level.	Available on all plans
Enterprise risk	A higher-level risk that groups related scenarios across registers, helping you connect team-level risks to broader organizational impact.	Available with Advanced Risk Management

From the Risks page, you can search and filter the risk scenarios in a risk register. Filter risks by fields like owner, status, and overall risk scores. Customize your table view using the controls icon to choose which columns to display and adjust how data is shown.

Risk registers

A risk register is a folder that contains your risk scenarios. You can use registers to group risks and control who can view or edit them. Depending on your plan, you might only have a single default register, or you may be able to create multiple registers to organize your risks.

💡 Tip: If you plan to import risks in bulk, set up your registers first so you can map each risk to the correct register during import.

Adding registers

If your account has access to create multiple risk registers, a register is created automatically with the name Default. New risks are added to this register unless you create additional registers. You can rename the default register at any time.

Create additional risk registers to organize risk scenarios based on how your program is structured—for example, by team, product, location, or risk domain.

To add a risk register:

On the Risks page, click the Add button.
Select Add register.
Enter a Name and Description for the register.
Click Add.
Manage access to control who can view or edit the risks in each register.

Editing or deleting registers

To edit a register’s name, description, or other settings, click the ••• menu and select Register settings.
To delete a register, click the ••• menu and select Delete register.

⚠️ Note: Deleting a register permanently deletes all risk scenarios within it. Move risk scenarios you want to keep to another register before deleting.

Managing register access

If your account has access to create multiple risk registers, you can control who can access each set of risks. Use register access to ensure the right people can view or manage risks while keeping sensitive information restricted.

To grant access to a risk register:

On the Risks page, click the ••• menu next to the risk register.
Select Manage access.
Add a user and assign their access level:
- Viewer: Can view risks in the register.
- Manager: Can view, add, and edit risks in the register.

You can also manage access by clicking the share icon within the risk register.

ℹ️ Note: Users need to granted the proper user permissions before they can be added to a register. Learn more

Risk scenarios

A risk scenario is a specific potential risk to your organization and the core unit you’ll assess, track, and manage. Add risk scenarios to a risk register or import them in bulk. Assign an owner to each scenario to give them access to complete risk assessments.

Adding a risk

To manually add a risk:

From the Risks page, open a risk register.
Click the Add button.
Enter a Description for the risk scenario.
If you’re using multiple risk registers, select the register to add the risk to.
If you use your own ID convention, add a Risk ID. Otherwise, leave it blank and we’ll generate one for you.
Click Add.

💡 Tip: You can also add risks via API or using our MCP.

Using the risk library

Vanta’s risk library includes common risk scenarios you can use to quickly build your risk inventory. You can choose whether to automatically add recommended controls to each risk so they map to your frameworks.

To edit your risk preferences:

In your account header, click the Settings icon.
In the page menu, scroll to the Features section and select Risk.
Go to the Preferences section.
Choose between:
- Always add recommended controls
- Ask me every time if I want to add recommended controls
- Never add recommended controls

To add risks from the risk library:

Go to the Risk library page.
Browse the available risk scenarios.
Click Add to register on a risk you want to use.
If you’re using multiple risk registers, select the register to add the risk to.

ℹ️ Note: To add the same risk to multiple registers, you’ll need to add the risk twice—once to each register.

Importing a spreadsheet

Import risk scenarios in bulk using a spreadsheet. Before importing, make sure any custom fields you want to include are already set up in your risk settings.

To import risks from a spreadsheet:

From the Risks page, open a risk register.
Click the Add button and select Import.
Review the instructions on the import page, download the CSV template, and prepare your file.
Upload a CSV file with your risk details. The only required column is Risk Scenario.
Map your spreadsheet columns to the corresponding fields in Vanta, then click Next.
Review your import, especially rows with issues, then click Import.

💡 Tip: You can export risks, make updates in a spreadsheet, and upload a file to bulk update existing risks using Risk ID. Before re-uploading, make sure the spreadsheet matches Vanta’s import template.

Managing risk access

Each risk scenario has two roles you can assign:

Risk Scenario Owner: Edit access to the risk scenario so they can complete assessments.
Risk Scenario Manager: Edit access to the risk scenario and can manage who has access to the risk scenario.

To manage access:

To assign an owner to a single risk scenario, click the Owner field in the risk register or in the risk scenario header.
To assign owners in bulk, select multiple risk scenarios in the risk register, then click Assign Owner from the toolbar.
To add manager, click the ••• menu next to the risk.

ℹ️ Note: Users need to granted the proper user permissions before they can be added to a risk. Learn more

Updating risks and risk assessments

Keep risk scenarios up to date by completing risk assessments to ensure risk details, risk mappings, risk scores, and treatment plans are properly documented and approved.

📖 Learn more: Completing Risk Assessments

Moving, exporting, and archiving risks

Keep your risk register organized by moving, archiving, and cleaning up risk scenarios over time:

Select risks from the table to move them between registers or to archive them.
Export risks to a spreadsheet and import them to update risks in bulk.
View archived risks to restore them or permanently delete them.

⚠️ Note: Deleting a risk scenario permanently deletes all risk details, assessment history, and associated tasks.

Enterprise risks

Enterprise risks are higher-level risk scenarios used to group related risks. They work the same way as risk scenarios, but live in a separate risk register and represent broader, cross-team visibility.

Use enterprise risks when you want to organize related risks or report on risk at a higher level across your organization:

Enterprise risks act as a parent to group related risk scenarios.
An enterprise risk links to multiple risk scenarios.
An individual risk scenario can be linked to one enterprise risk.
Enterprise risks use the same fields, assessments, and workflows as risk scenarios.
Only Admins and Editors can view, manage, own, or approve enterprise risks.

Risk customization

Customize the fields your team will use to define and evaluate risk scenarios. This includes adding categories and metadata to capture the right context, and aligning your scoring rubric with how your organization assesses risk. Setting this up early ensures your risk data is consistent, meaningful, and ready to support assessments and reporting.

Adding custom fields

Custom fields let you capture additional details for your risk scenarios beyond the default fields. Once added, these fields appear when editing a risk scenario so your team can consistently track the information that matters most.

You can apply custom fields to all registers or limit them to specific registers. When you add a risk register, it inherits all custom risk fields by default. Enterprise risks include all custom fields by default since they map across registers.

To add custom fields:

In your account header, click the Settings icon.
In the page menu, scroll to the Features section and select Risk.
Scroll to Custom fields and click Add.
Enter a Field label and Description.
Select a Data type: Currency, Date, Number, Multi-select, Text, or User. You can’t change the data type after creating the field.
Choose the risk registers the field applies to.

To edit custom fields per risk register:

Use the dropdown menu to select a risk register.
Click the ••• menu next to a field to update which registers it applies to.
Drag and drop fields to reorder them.

Adding custom categories

Custom categories let you label and group risk scenarios based on your organization’s needs. Once added, categories are available as a selectable field when editing a risk scenario, making it easier to classify and filter risks.

To add custom categories:

In your account header, click the Settings icon.
In the page menu, scroll to the Features section and select Risk.
Scroll to the Custom categories section.
Click Add and enter a category name.
Click Add category.

Editing your scoring rubric

Depending on your plan, you can customize your risk scoring rubric to reflect how your organization evaluates risk.

Managing Risks and Risk Registers