> For the complete documentation index, see [llms.txt](https://engyon.gitbook.io/engyon/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://engyon.gitbook.io/engyon/en/how-to-guides/risks/creating-a-risk.md).

# Creating a risk

Risks are formulated on the basis of inherent risk factors and internal control, each provided with an assertion, chance and impact assessment, and a link to the relevant internal control measures.

### **Related information**

If you have little experience with Engyon, we advise you to first take note of the information on the following pages:

* [Training module 6: Risk assessment (3 points model)](/engyon/en/training/training-english/module-6-risk-assessment-three-point-model.md) / [(Audit Risk Model)](/engyon/en/training/training-english/module-6-risk-assessment-audit-risk-model.md)
* [Create risks without a linked IRF](/engyon/en/how-to-guides/risks/create-a-risk-without-an-irf.md)

### Create risk with linked IRF <a href="#create-risk-with-linked-irf" id="create-risk-with-linked-irf"></a>

1. Go to the `Risk assessment` screen and click on the title of the IRF to which you want to link a risk.
2. In the IRF, click `Manage risks` at the bottom right.
3. You can now link the IRF to an already created (existing) risk or to a new risk to be created;
4. If the field <kbd>Tags</kbd> is under Details, choose the tags that belong to this risk. You can also leave the field empty.
5. Link audit units and financial statement line items to the risk.

   > **TIP:** the audit units on the Inherent risk factor must contain at least the audit units of the risk.

   Select the audit unit of that component in the main audit first. Until you do, the audit unit in the coupled audit cannot be selected.
6. Select `General risk` if it concerns a risk that is not related to specific financial statement line items and assertions, but which has a pervasive influence on the financial statements as a whole and possibly influences a large number of assertions. That is to say, a *risk at the level of the financial statements* (Standard 315.28).\
   When switching on 'General risk', no financial statement line items and assertions can be selected afterwards.

{% hint style="info" %}
When a risk at the level of the financial statements also influences individual line items and assertions (such as, for example, the risk of management override or continuity, Standard 315 A194 and A195), link two risks to the underlying IRF, namely:

1. a general risk, to which you link the general procedures, and
2. a specific (non-general) risk, linked to the relevant financial statement line items and assertions, to which you link specific procedures.

In Audits created before July 1, 2026, you cannot link general procedures to risks. In that case, link a specific procedure, in which you manually refer to the relevant general procedure, to the risk.
{% endhint %}

7. Select a financial statement line item and assertion with it. As soon as a financial statement line item is selected, you can choose from the assertions linked to the inherent risk factor, or all assertions if no assertions are selected in the IRF. Select a financial statement line item multiple times if the risk covers multiple assertions of a line item.

{% hint style="info" %}
You do not remove an assertion on the line item. The assertion letter (for example A for Accuracy) lights up blue there while a test plan for that assertion is in draft. Open the risk, go to <kbd>Scope</kbd> in the left column, and at <kbd>Financial statement line items</kbd> hover over the tags. Click the pen icon (<i class="fa-pen">:pen:</i>), remove the line item and assertion pair, and click <kbd>Save</kbd>.
{% endhint %}

8\. When an inherent risk factor is marked as a fraud risk factor, the \`Fraud risk toggle\` is automatically on and the linked risk is automatically marked as significant. 9. For Audit Risk Model: Indicate whether your inherent risk is Low, Medium or High and create the risk.

### Link internal control measure

1. In the `Risk assessment` screen, click on the title of a risk on the right side to open the risk details screen.
2. Within the risk details screen, you can adjust the `Risk Analysis` and link `Internal Control Measures`.
3. For Audit Risk Model: fill in the `Degree of risk` (inherent risk, internal control risk and risk of material misstatement).

### Create risks without a linked IRF

You can also create risks without a linked IRF, read [here ](/engyon/en/how-to-guides/risks/create-a-risk-without-an-irf.md)how you do that.