# Risk assessment

URL: /systems/trust-and-governance/controls/risk-assessment · Id: `control:risk-assessment`

> Agents prepare each period’s risk assessment from Incidents, Issues and Changes, and the entity’s officer accepts it by Decision.

[Agents](/business/nouns/agent) prepare each period’s risk assessment from [Incidents](/business/nouns/incident), [Issues](/business/nouns/issue) and [Changes](/business/nouns/change), and the entity’s officer accepts it by [Decision](/business/nouns/decision).

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC3.1](/systems/trust-and-governance/criteria/soc2/cc3-1) | The entity specifies objectives precisely enough to identify and assess the risks that relate to them. |
| [SOC2 CC3.2](/systems/trust-and-governance/criteria/soc2/cc3-2) | The entity identifies risks to its objectives across the entity and analyzes them to decide how to manage them. |
| [SOC2 CC9.1](/systems/trust-and-governance/criteria/soc2/cc9-1) | The entity identifies, selects and develops risk mitigation activities for risks from potential business disruptions. |
| [HIPAA 164.308(a)(1)](/systems/trust-and-governance/criteria/hipaa/164-308-a-1) | A covered entity implements policies and procedures to prevent, detect, contain and correct security violations, including risk analysis. |

## Implemented by
- [Compliance](/workflows/processes/compliance)
- [Strategy](/workflows/processes/strategy)
- [Compliance](/systems/compliance)
- [Officer desk](/business/glossary)

## Test
| Step | Rule |
| --- | --- |
| Kind | Detective: it finds the failure after it happens. |
| Select | Every report period of every entity in scope. |
| Assert | Each period has a risk assessment Document and an officer’s Decision accepting it, signed before the period ends. |

## Owner
[Founder](/agents/founding/founder), [Founding Team](/agents/founding).

## Example
At quarter end, Agents draft the risk assessment for a home-appraisal service from 3 Incidents, 12 Issues and 80 Changes. The officer accepts it by Decision before the quarter closes.