When using questionnaires in UpGuard, automated risks are generated based on vendor responses when gaps or potential risks are inherent in their response. This approach works well for yes/no and multi-select questions but does not cover risks based on reviewing more open-ended responses including free-text answers or document uploads.

To cater for the instance where additional risks are identified based on reviewing questionnaire responses we have added the ability to add manual risks to a questionnaire.

To add a manual risk to a questionnaire, select the icon next to the question and select add manual risk.

From here, follow the steps to add a specific risk to the questionnaire. You can either choose to use a previously created risk or create a new one. Manual risks are shared across questionnaires and additional evidence, so you can leverage and create consistency across both sources. If you create a new risk, you will be prompted to enter a finding, severity and impact for that new risk.

Once you select Add risk, risk will be added to the questionnaire. Manual risks do not affect the questionnaire score, and will not be visible to the vendor unless the manual risk is included in a remediation request.

You can also edit or delete risks at any time once you have added them, and manual risks can be included in remediation requests to the vendor, at which time they will become visible to the vendor.