Configure Risk Methodology
Welcome to the Risk Configuration Guide for the GRC for Jira plugin. This guide is designed to help you configure your risk management process in a way that fully supports your organization’s risk methodology.
All risk-related settings can be configured on the Settings → Risk Settings page. This guide provides a structured, step-by-step approach to each configuration section, ensuring that your setup aligns with your chosen risk assessment approach.
Need Help?
The risk configuration process can be complex, especially when aligning it with a custom risk methodology. If you need assistance, our team is happy to walk you through the setup step by step.
Don’t hesitate to contact us for support or to schedule a configuration session.
Before You Start
Before diving into the configuration, it’s important to consider the following aspects of your risk methodology:
Assessment Type
What type(s) of risk assessments will your organization use?Qualitative – based on descriptive likelihood and impact scales.
Quantitative – using numerical values such as annualized loss or frequency.
Both – a hybrid approach combining both types.
Within the guide, we’ll highlight with labels (QUANTITATIVE) which configurations apply specifically to qualitative or quantitative assessment types .
Methodology Complexity
Does your organization already use a custom or regulated methodology (e.g., specific scales, formulas, matrices)?
If yes, a more thorough and careful configuration will be required to reflect your existing model.Calculation vs Lookup-Driven Logic
Should your methodology rely on:Calculation-driven logic – e.g., multiplying impact and likelihood to determine risk levels.
Selective/lookup-based logic – e.g., using lookup tables to define risk levels, control factors, or residual risk.
Risk Matrix Customization
Are you already using a custom risk matrix?
If your risk levels are not calculated as a product of impact and likelihood but are instead defined as intersections within a matrix (lookup approach), this needs to be reflected in the Risk Matrix configuration section.Access Requirements
To access the Risk Settings page and perform configuration:
a. The user must be a member of the GRC Configuration Manager role, or have Jira Org Admin permissions.
b. Certain configuration options (such as modifying Risk Parameters names) may only be available to Jira Org Admins.
Ensure that the person responsible for configuration has the appropriate permissions or admins support before proceeding.
Answering these questions will guide your configuration path and ensure alignment with your organizational needs.