--- title: 05.05 The Risk Catalog description: SimpleRisk ships a catalog of pre-defined risks and threats that submitters can pick from when filing a new risk. The catalog accelerates and… --- [Skip to content](https://support.simplerisk.com/kb/05-05-the-risk-catalog#main-content) English Show submenu for translations [Customer portal](https://support.simplerisk.com/tickets?hsLang=en) [![SimpleRisk logo of a man walking a tight rope](https://support.simplerisk.com/hs-fs/hubfs/simplerisk_logo_long_small-4.png?width=377&height=72&name=simplerisk_logo_long_small-4.png)](https://www.simplerisk.com/) Open main navigation Close main navigation - English Show submenu for translations - [Customer portal](https://support.simplerisk.com/tickets) - [Contact us](https://www.simplerisk.com/about-us/contact-us) [Contact us](https://www.simplerisk.com/about-us/contact-us) How can we help you? - There are no suggestions because the search field is empty. 1. [SimpleRisk Knowledge Base](https://support.simplerisk.com/kb?hsLang=en) 2. [Administrator Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en) 3. [05 Customization](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#05-customization) # 05.05 The Risk Catalog ## SimpleRisk ships a catalog of pre-defined risks and threats that submitters can pick from when filing a new risk. The catalog accelerates and standardizes submissions — instead of writing risk descriptions from scratch, submitters select a catalog entry and the form pre-populates. Manage the catalog at Settings cog → Risk Catalog. ## Why this matters Two failure modes plague open-text risk submissions: (1) every submitter writes the same well-known risk differently ("Phishing attack" / "Phishing campaign" / "Email-based credential harvest" all turn into separate-looking register entries), and (2) submitters who aren't risk specialists don't know what good risk descriptions look like, so they write thin or vague entries. The risk catalog addresses both: a maintained list of pre-defined risks (and a parallel threat catalog) that submitters can pick from on the submission form. Pick "R-001: Phishing — credential harvest via email link" and the form pre-populates with the standard description; everyone who picks it produces consistent register entries; submitters who don't know what to write get the prompt of "what's already on the catalog?" The honest scope to know up front: **the catalog is opt-in for submitters, not enforced**. The submission form lets submitters either pick from the catalog or write a custom risk from scratch. There's no setting that says "must pick from catalog." Programs that want to enforce catalog use rely on operational policy, not a system gate. The other thing worth knowing: **SimpleRisk ships with default catalog content**. Out of the box, both catalogs come loaded with a starter set of common risks and threats. Most programs find the defaults a useful starting point but extend or replace them with organization-specific entries. The default content is editable; nothing is fixed. The third thing: **the catalog is two related catalogs**, not one. The risk catalog holds risk events — what could happen. The threat catalog holds threats — what could cause it to happen. On the submission form, submitters typically pick one risk-catalog entry plus one or more threat-catalog entries. The two are managed via the same admin page but represent different concepts. The fourth thing: **catalog entries are organized by groupings**. Each risk-catalog entry belongs to a **Risk Grouping** (a high-level category like "Application Risk," "Vendor Risk," "Operational Risk"); each threat-catalog entry belongs to a **Threat Grouping** ("Adversarial Threats," "Accidental Threats," etc.). The groupings are managed via the dropdown-management surface ([Managing Dropdown Values](https://support.simplerisk.com/kb/05-04-managing-dropdown-values?hsLang=en)) and provide the structure for the catalog UI's filtering and search. ## Before you start Have these in hand: - **Admin access** to the Settings Hub (Settings cog, top-right of any page) → **Risk Catalog** tile for the management UI. - **A plan for which risks and threats your program needs in the catalog.** Don't start by trying to populate every conceivable risk; start with the 10–30 most-common ones for your program. Add more as patterns emerge from real submissions. - **An understanding of the risk-grouping and threat-grouping taxonomy** you'll use. The default groupings ship with SimpleRisk; many programs extend or replace them. Decide on the taxonomy before populating catalog entries (re-organizing later means moving every entry). - **A backup** if you're going to delete or replace the default catalog. Default entries can be useful starting points; once deleted, restoring them requires either a database restore or hand-recreation. ## Step-by-step ### 1. Review the default catalog content Before customizing, see what ships: 1. Settings cog → Settings Hub → **Risk Catalog** tile opens the catalog management page. 2. Browse the existing risk-catalog and threat-catalog entries. 3. Note which entries are useful as-is, which need editing, and which are irrelevant to your program. The default content covers common information-security and operational risks. Programs in specialized industries (healthcare, financial services, critical infrastructure) may find it generic; programs in mainstream technology may find it directly applicable. ### 2. Configure the risk and threat groupings If the default groupings don't fit, edit them via [Managing Dropdown Values](https://support.simplerisk.com/kb/05-04-managing-dropdown-values?hsLang=en) → the **Risk Grouping** and **Threat Grouping** lookups. Common patterns for risk groupings: - **By NIST SP 800-30 categories** — Information Security, Privacy, Operational, Strategic. - **By function** — Application Security, Vendor Risk, Infrastructure, Compliance, etc. - **By the program's existing taxonomy** — match whatever your program already uses in committee discussions and reporting. Common patterns for threat groupings: - **NIST SP 800-30 threat sources** — Adversarial, Accidental, Structural, Environmental. - **MITRE ATT&CK tactics** for technology-focused programs. - **A flat structure** if grouping doesn't add much (small programs). Pick what makes the catalog discoverable for your submitters; don't over-engineer. ### 3. Add new risk-catalog entries Settings cog → Settings Hub → **Risk Catalog** tile. The page shows the existing entries; the **Add Risk** button (or equivalent) opens the entry-creation form. For each new entry: - **Number** — a short identifier (e.g., "R-001"). The convention varies by program; many use a sequential numeric prefix per grouping. - **Grouping** — the risk-grouping this entry belongs to. - **Name** — the risk event name (e.g., "Phishing: credential harvest via email link"). Should be specific enough that a submitter can recognize the risk; don't make it so generic that multiple distinct risks could share it. - **Description** — the standard description that pre-populates the submission form when this entry is picked. Write the description as a complete risk statement: what could happen, what would be affected, why it matters. - **Function** — optional dropdown for risk function classification. Save. The entry appears in the catalog listing and is immediately available on the submission form. ### 4. Add new threat-catalog entries The threat-catalog entries follow the same pattern: - **Grouping** — the threat-grouping. - **Name** — the threat (e.g., "External attacker with phishing capability"). - **Description** — what the threat actor or threat condition is and why it matters. Threats are usually less specific than risks; one threat can manifest in many risks. Don't create per-risk threats; create generic threats that aggregate well. ### 5. Edit or delete existing entries To edit: 1. Click an existing entry. 2. The entry-editing modal opens with the current values. 3. Change as needed; save. To delete: 1. Confirm the entry isn't currently referenced by any submitted risk (if it is, the deletion may produce orphans similar to dropdown deletion — see [Managing Dropdown Values](https://support.simplerisk.com/kb/05-04-managing-dropdown-values?hsLang=en)). 2. Delete via the entry's delete control. Deleting a catalog entry doesn't delete risks that were submitted using it; the risks keep their description (which was copied from the catalog at submission time) and aren't affected by subsequent catalog edits or deletions. ### 6. Reorder entries within a grouping The catalog UI may support drag-to-reorder within a grouping (the page uses the `update_order` API endpoint to save reordering). Where supported: 1. Drag entries up or down within the grouping list. 2. The order saves automatically. Reordering controls how entries appear in the submission form's catalog picker. Put the most-common-for-your-program entries at the top. ### 7. Verify the catalog on the submission form Test from a non-admin account: 1. Log in as a test submitter. 2. Open the risk submission form. 3. Activate the catalog picker (the form typically shows it as a dropdown or modal). 4. Confirm: - Your groupings appear in the right order. - Your entries appear under the correct groupings. - Picking an entry pre-populates the form with the entry's description. 5. Submit the test risk; confirm the description was captured correctly. Iterate until the catalog feels usable from the submitter's perspective. ### 8. Maintain the catalog over time The catalog is most useful when it's curated. Periodic reviews: - **Monthly or quarterly**: review which catalog entries are getting picked vs ignored. Drop the unused ones; add new ones for risks that keep getting submitted as custom-text variations. - **At incidents or audit findings**: when an incident or audit surfaces a risk pattern that wasn't in the catalog, add it. Future submitters benefit from the new entry. - **Annually**: revisit the groupings. Did the program's taxonomy shift? Is the catalog still organized usefully? A maintained catalog is a sharp tool; an unmaintained one becomes stale and submitters stop trusting it. Treat it like documentation: deliberately maintained beats deliberately created and then ignored. ## Common pitfalls A handful of patterns recur with the risk catalog. - **Dumping every conceivable risk into the catalog at startup.** A 500-entry catalog is unusable for submitters; they can't find the right one. Start with 20–30; grow deliberately. - **Writing catalog entries that are too generic.** "Security risk" or "Operational risk" are useless catalog entries — submitters can't pick which "Security risk" they mean. Make entries specific enough to be the right pick for a specific situation. - **Writing catalog entries that are too specific.** "Credential phishing using a Google-themed lure during the third week of December" is too specific to be reusable. Aim for the level of specificity that lets the same entry apply across many submissions. - **Forgetting that the description pre-populates the submission form.** Catalog descriptions become the submitted risk's description. Write them as complete risk statements, not as catalog tags. - **Treating the catalog as enforced.** Submitters can write custom risks that don't reference the catalog. If catalog use matters operationally, communicate the expectation; don't expect the system to enforce it. - **Letting the catalog grow without curation.** Stale entries accumulate; new patterns aren't captured; submitters stop using it. Schedule periodic reviews. - **Reorganizing the groupings frequently.** Each reorganization invalidates training and muscle memory. Get the groupings right early; resist re-shuffling. - **Conflating risk-catalog and threat-catalog.** A risk is what could happen; a threat is what could cause it. Don't put threats in the risk catalog or vice versa; the two have different uses on the submission form. - **Forgetting that catalog deletes don't cascade to existing risks.** A risk submitted using catalog entry "R-042" keeps its description even after R-042 is deleted; the historical record is fine. But future submitters won't see R-042 as a pick. Deletion affects the future, not the past. - **Not coordinating catalog changes with the team that owns submission training.** New entries need to be in training materials; renamed entries break references in old training. Coordinate before bulk catalog updates. ## Related - [Custom Fields](https://support.simplerisk.com/kb/05-01-custom-fields?hsLang=en) - [Custom Risk Scoring](https://support.simplerisk.com/kb/05-02-custom-risk-scoring?hsLang=en) - [Mitigation Controls Customization](https://support.simplerisk.com/kb/05-03-mitigation-controls-customization?hsLang=en) - [Managing Dropdown Values](https://support.simplerisk.com/kb/05-04-managing-dropdown-values?hsLang=en) - [Submitting a Risk](https://support.simplerisk.com/kb/01-02-submitting-a-risk?hsLang=en) (the submitter-facing view of the catalog) - [FAQs](https://support.simplerisk.com/kb/faqs?hsLang=en) - [SimpleRisk Extras](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#main-content) - [Vulnerability Management Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#vulnerability-management-extra) - [Team Separation Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#team-separation-extra) - [Import-Export Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#import-export-extra) - [Administrator Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#main-content) - [00 About This Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#00-about-this-guide) - [01 Installation and Deployment](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#01-installation-and-deployment) - [02 Upgrades and Maintenance](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#02-upgrades-and-maintenance) - [03 Users and Permissions](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#03-users-and-permissions) - [04 Authentication](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#04-authentication) - [05 Customization](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#05-customization) - [06 Configuring Risk and Compliance](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#06-configuring-risk-and-compliance) - [07 Integrations](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#07-integrations) - [08 The API](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#08-the-api) - [09 Encryption and Data Security](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#09-encryption-and-data-security) - [10 Workflows and Automation](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#10-workflows-and-automation) - [11 Reporting and Auditing](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#11-reporting-and-auditing) - [12 Operations](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#12-operations) - [13 Reference](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#13-reference) - [User Guide](https://support.simplerisk.com/kb/user-guide?hsLang=en#main-content) - [00 Foundations of GRC](https://support.simplerisk.com/kb/user-guide?hsLang=en#00-foundations-of-grc) - [01 Risk Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#01-risk-management) - [02 Compliance Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#02-compliance-management) - [03 Governance](https://support.simplerisk.com/kb/user-guide?hsLang=en#03-governance) - [04 Asset and Data Inventory](https://support.simplerisk.com/kb/user-guide?hsLang=en#04-asset-and-data-inventory) - [05 Threat and Vulnerability Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#05-threat-and-vulnerability-management) - [06 Assessments](https://support.simplerisk.com/kb/user-guide?hsLang=en#06-assessments) - [07 Incident Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#07-incident-management) - [08 Audit and Reporting](https://support.simplerisk.com/kb/user-guide?hsLang=en#08-audit-and-reporting) - [09 Day-to-Day SimpleRisk](https://support.simplerisk.com/kb/user-guide?hsLang=en#09-day-to-day-simplerisk) - [10 Continuous Improvement](https://support.simplerisk.com/kb/user-guide?hsLang=en#10-continuous-improvement) - [SimpleRisk User Guides](https://support.simplerisk.com/kb/simplerisk-user-guides?hsLang=en) - [Troubleshooting](https://support.simplerisk.com/kb/troubleshooting?hsLang=en) - [SimpleRisk Hosted](https://support.simplerisk.com/kb/simplerisk-hosted?hsLang=en) - [How To videos](https://support.simplerisk.com/kb/how-to-videos?hsLang=en) [![favicon-1](https://support.simplerisk.com/hs-fs/hubfs/favicon-1.png?width=35&height=35&name=favicon-1.png "favicon-1")](https://www.simplerisk.com) Copyright © 2026, SimpleRisk, Inc.