---
title: 09.04 Search
description: Core SimpleRisk searches one table at a time, through the search box and filters on each list. The Advanced Search Extra adds a topbar search and a…
---
[Skip to content](https://support.simplerisk.com/kb/09-04-using-search#main-content)
English
Show submenu for translations
[Customer portal](https://support.simplerisk.com/tickets?hsLang=en)
[](https://www.simplerisk.com/)
Open main navigation
Close main navigation
- English
Show submenu for translations
- [Customer portal](https://support.simplerisk.com/tickets)
- [Contact us](https://www.simplerisk.com/about-us/contact-us)
[Contact us](https://www.simplerisk.com/about-us/contact-us)
How can we help you?
- There are no suggestions because the search field is empty.
1. [SimpleRisk Knowledge Base](https://support.simplerisk.com/kb?hsLang=en)
2. [User Guide](https://support.simplerisk.com/kb/user-guide?hsLang=en)
3. [09 Day-to-Day SimpleRisk](https://support.simplerisk.com/kb/user-guide?hsLang=en#09-day-to-day-simplerisk)
# 09.04 Search
## Core SimpleRisk searches one table at a time, through the search box and filters on each list. The Advanced Search Extra adds a topbar search and a Search page that find risks, frameworks, controls, documents, exceptions, tests, audits, assets and asset groups (and, when your install has those Extras, incidents, sent questionnaires and scanner vulnerabilities) from one box, showing only what you're allowed to see.
## Why this matters
Finding things in a working SimpleRisk install matters every day. The risk you submitted last week, the policy that justifies a control, the asset whose name you can't quite remember, the audit finding that came up in last month's meeting: all of these need to be findable on demand. The gap between "I can find anything quickly" and "I have to open three menus to locate one record" is the gap between a program people use and one that hurts to operate.
Core SimpleRisk has no search-everything box. Its search lives in each list: the risk list has its own search, the control table has its own search, the document list has its own search, and so on. Programs migrating from tools with a global search bar find this surprising. You can still find almost anything, but you have to be on the right list first.
The **Advanced Search Extra** changes that. With it active, the search box in the topbar searches risks, frameworks, controls, documents, exceptions, tests, audits, assets and asset groups at once (and, when your install has those Extras, incidents, sent questionnaires and scanner vulnerabilities), and a full Search page lets you work through the results type by type. It searches only what you could open yourself: a type your role can't reach isn't searched at all, and when team separation is on, both the results and the counts leave out records outside your teams. Without the Extra, the topbar box is still there, but it's locked, and clicking it tells you what the Extra would add.
Per-table search is still worth knowing either way. It's server-side, it matches against most visible columns, and when you already know which list a record lives on it's usually the fastest path to it.
## Before you start
Have these in hand:
- **A logged-in SimpleRisk session** with permissions for the records you want to find.
- **A specific query.** "That risk we talked about" doesn't translate to a search; "phishing" does. Concrete words return useful results.
- **For per-table search, the right list.** A risk search runs against the risk list, not the document list.
- **For the topbar search, the Advanced Search Extra.** If the topbar box reads **Search your whole program** with a **Locked** badge, the Extra isn't active on your install. See step 8.
- **For each type you want the topbar search to cover, the permission that opens it.** Risks need **Allow Access to "Risk Management" Menu**. Frameworks, controls and documents need **Allow Access to "Governance" Menu**, and exceptions need that plus **Able to View Exceptions**. Tests and audits need **Allow Access to "Compliance" Menu**. Assets and asset groups need **Allow Access to "Asset Management" Menu**. With their Extras active, incidents need **Allow Access to Incident Management "Incidents" Menu**, sent questionnaires need both **Allow Access to "Assessments" Menu** and **Able to View Questionnaire Results**, and vulnerabilities need **Allow Access to Vulnerability Management "Vulnerabilities" Menu**. A type you lack the permission for simply isn't searched.
## Step-by-step
### 1. Use the per-table search on the relevant list
The most common search uses the search box that's part of almost every table in SimpleRisk, usually at the top right of the table.
1. Open the list that holds the records you're after. - **Risks**: Sidebar **Risk Management → Review Risk** for the risks that need attention now. For the wider register, closed risks included, use the **Dynamic Risk Report** (step 9). - **Frameworks and controls**: Sidebar **Governance → Define Control Frameworks**. The framework rail and the controls table each have their own search box. - **Documents**: Sidebar **Governance → Document Program**. - **Exceptions**: Sidebar **Governance → Define Exceptions**. - **Assets**: Sidebar **Asset Management → Manage Assets**. - **Vulnerabilities** (with the Vulnerability Management Extra): Sidebar **Vulnerabilities → Vulnerabilities**. - **Incidents** (with the Incident Management Extra): Sidebar **Incidents → Identification** for new incidents, or **Incidents → Response** for ones in progress. - **Assessment contacts and questionnaire results** (with the Assessments Extra): Sidebar **Assessments → Assessment Contacts** or **Assessments → Questionnaire Results**.
2. Type your query in the table's search box. It matches against most of the table's visible text columns, and partial words match.
3. The table refreshes, often as you type, to show only the matching rows.
### 2. Use per-column filters for structured search
Beyond the free-text box, most tables let you constrain rows by the value in a column: only Open risks, only risks owned by one person, only items due in a date range, only High and Very High scores. Filters and the text search compose. "Every open High risk owned by Sara that mentions cloud" is a couple of filter choices plus one search.
### 3. Search everything from the topbar (Advanced Search Extra)
With the Extra active, the topbar box reads **Search your whole program** and works as you type. Press `/` anywhere in SimpleRisk, outside a text field, to jump into it.
1. **Type at least two characters.** Results appear after a brief pause. Each type that matched gets its own group, headed by the type's name and how many records matched; you see up to three records per type. Groups are ordered by how well their best record matches, not in a fixed order. Each record shows its title (a risk or an incident also shows its ID) and either the line where your words matched, highlighted, or a short description.
2. **Look for a Top hit.** If what you typed is exactly a risk ID or exactly one control's number, that record is pinned above the groups as the **Top hit**, already highlighted.
3. **Move with the arrow keys and press Enter.** The up and down arrows move through the records and the **See all results for “{your query}”** row at the bottom. Enter opens the highlighted record. With the Top hit highlighted, Enter opens that record straight away; with nothing highlighted, Enter takes you to the Search page. You can also click any row. **Esc** closes the list.
A count of **99+** means more than 99 records matched; the count stops there. If the list ends with **Results may be incomplete.**, the search couldn't cover everything in the time it had. Make the query more specific, or open the Search page.
If no record matches, the list says **No results for “{your query}”** and suggests checking the spelling or trying fewer words. If the search itself fails, you'll see **Couldn’t search right now** with a **Retry** link; your data isn't affected.
### 4. Work through the results on the Search page
The Search page is where "See all results" takes you, and where Enter lands when no record is highlighted. It has no sidebar entry; the topbar is the way in. The query sits in its own box at the top with a **Search** button, so you can refine it without leaving the page.
Under the query, a summary line reads like **Results: 37 · Types searched: 9**. On the left, the **Types** rail lists **All types** and then each type you're allowed to search, each with its count. A type with no matches stays in the rail but is greyed out. A type you can't access isn't listed at all; it's not shown as zero, because it wasn't searched. On a narrow screen the rail folds behind a **Types · 9** button (the number is how many types you can search).
Types that come with other Extras sit at the bottom of the rail, under a **From your Extras** heading: **Incidents** (Incident Management Extra), **Assessments** (Assessments Extra) and **Vulnerabilities** (Vulnerability Management Extra). Each one is there only while its Extra is active and your role can reach it, and the heading disappears when none of them is. Assessments needs two permissions, the Assessments menu and **Able to View Questionnaire Results**, because what it finds are sent questionnaires, the same records the **Questionnaire Results** page lists. A questionnaire sent to five people is five results; each row names the recipient and how far along they are. Vulnerabilities searches only the scanners an administrator has turned on in the Vulnerability Management Extra, so on an install with no scanner configured the type doesn't appear at all.
Incidents follow team separation the way risks do. Sent questionnaires and vulnerabilities follow their own pages instead: if you can open **Questionnaire Results** or **Vulnerabilities**, search finds every record that page lists for you, whatever your teams.
1. **Scan the All types view.** Each type with matches gets a card with up to five records and a **View all** link. Every row shows the record's title (linked), a short description, a status or level pill where the type has one, and a **Matched in {field}:** line showing the words that matched, highlighted. That line is the fastest way to tell why a record turned up: a risk that matched in its **Subject** is usually a better lead than one that matched somewhere in its mitigation text.
2. **Open one type.** Click a type in the rail, or **View all** on its card, to see every match of that type as a paged list.
3. **Narrow with Matched in and Sort.** The one-type view has two dropdowns. **Matched in** limits the list to records that matched in one field (a risk's **Subject**, a control's **Control Number**, an asset's **IP Address**, an incident's **Details**, a vulnerability's **Scanner ID**, and so on); **Any field** removes the limit. **Sort** switches between **Best match**, the default, and **Name**, which sorts alphabetically by title.
4. **Page through.** The list shows 25 records at a time. **Next** moves forward and **First page** jumps back to the start; your browser's Back button steps back one page. One type's list stops at 500 records. If what you need isn't in those, the query is too broad.
5. **Share what you're looking at.** The query, the type, **Matched in**, **Sort** and the page are all in the address bar. Copy the URL and a colleague who opens it gets the same search, filtered to what *they're* allowed to see.
A few states you'll run into:
- **"Type at least 2 characters to search."** The query is too short to run.
- **"No results for “{your query}”"** comes with a tip and a **Clear search** button.
- **"Couldn’t search right now"** comes with a **Retry** button. Nothing in your data changed.
- **"Your account can’t search any record types."** Your role has none of the permissions the search types need. Ask an administrator.
### 5. When results may be incomplete
Search keeps itself fast by putting limits on how much it reads, and it tells you when one of those limits cut a search short instead of quietly leaving records out. You'll see a **Results may be incomplete.** note in two forms.
- **Inside one type's card**: "This type searched its most recent records only." On a very large register, or on an install where the Encrypted Database Extra is active, a type can stop after its most recent records. The count for that type then ends in **+** (for example, **12+**), meaning "at least this many." Vulnerabilities reach this limit sooner than any other type. A single scanner import can bring in thousands of findings, so each scanner is searched only over its most recent few hundred, and after a large import the **Vulnerabilities** count often ends in **+**.
- **Above all the results**: "Search stopped early to stay fast, so some types were not searched." The whole search runs under a time limit of a few seconds. A type it didn't reach shows a dash instead of a count in the rail; hover over the dash and it says **Not searched**.
The fix is the same for both: narrow the query. Add a word, use a more distinctive term, or open the one type you care about and filter it with **Matched in**. A query like "control" matches a large share of any governance program; "quarterly access review" doesn't.
### 6. See what a result connects to
Most rows carry two buttons at their right edge.
The **chevron** expands the row in place to show **Connected records**: the records linked to this one, grouped by type with a count for each, up to five per type and a **+N more** note when there are others. Click a record to open it in the Connectivity Explorer (the **Connectivity Visualizer** report), centered on that record. The panel shows only records you have access to, and says so; if nothing connected is visible to you, it reads **No connected records you can see.**
The **More actions** menu (the **⋯** button) offers:
- **Open**: the record's own page.
- **Explore connections**: the Connectivity Explorer, focused on this record, for when you want to follow the links more than one hop out. The same button sits at the bottom of the connected-records panel.
- **Copy link**: copies the address of the record's page to your clipboard, for pasting into a ticket or a chat.
Not every row has both buttons. A vulnerability never has the chevron or **Explore connections**, because a scanner finding has no single record in the Connectivity Explorer; its menu holds **Open** and **Copy link** only. And if your role can't open the Connectivity Explorer at all (that takes access to the Risk Management, Governance, Compliance or Asset Management menu, or **Able to View Exceptions**), no row has them. A role that can only reach incidents or questionnaire results is the usual case.
### 7. Know where a result takes you
Opening a result lands you on that record's usual page:
- A **risk** opens its risk view.
- A **control** opens **Define Control Frameworks** on a framework the control belongs to, with the control's number already typed into the table's search box and the control's row highlighted. Clear that search box when you're done, or the table stays narrowed to one control.
- A **framework** opens **Define Control Frameworks** with that framework selected, even if it isn't active.
- An **exception** opens **Define Exceptions** with the exception open, in the edit form if you're allowed to change exceptions and read-only if you're not.
- An **asset** opens that asset's record on **Manage Assets**; an **asset group** opens the asset groups list, searched for that group's name.
- **Documents**, **tests** and **audits** open their own pages in the Governance and Compliance areas.
- An **incident** opens its **Response** view in the Incident Management Extra, whether it's still open or already closed.
- A **sent questionnaire** (an **Assessments** result) opens that result in full on **Questionnaire Results**.
- A **vulnerability** opens the **Vulnerabilities** page, not the single finding; the page has no address for one finding. It opens on the **Triage Vulnerabilities** tab, so a finding that's already been turned into a risk is one click away, on **View Risks**. Search covers only what that page lists: untriaged findings that aren't hidden, and findings already turned into risks. Don't expect the counts to agree exactly, either. The page counts findings with the same title once, while search counts each one, so search's number can be the higher of the two.
Search only lists records you can see, but a shared link can still point at one you can't, or at one that's since been deleted. For controls and exceptions, the page then opens normally and shows a short notice instead of the record. For a control: "That control isn’t available. It may have been deleted, or you may not have access to it." For an exception: "That exception can’t be opened here. You may not have access to its policy document." An exception can show up in search because you can see its control while its policy document is hidden from you, which is why that second message exists.
### 8. If the topbar box is locked
Without the Extra, the topbar shows **Search your whole program** with a **Locked** badge, and nothing can be typed into it. Click it for a short note on what the Extra adds, with the record types it covers listed under **Unlocks search across**. That list is the nine built-in types only; incidents, assessments and vulnerabilities also depend on their own Extras, so the note leaves them out. The note ends with the next step for your situation: **See what it adds** if the Extra isn't installed, **Turn it on** if it's installed but switched off, or "An administrator can set this up." if you aren't an administrator. Opening the Search page directly shows the same explanation as a card.
### 9. For questions search can't answer, use reports
When the question is analytical ("which risks are past their next review date, by team?"), a report usually beats a search. Under **Reporting → Reports**:
- **All Open Risks Needing a Review** (`/reports/review_needed.php`): risks past their next-review date.
- **All Open Risks by Team by Risk Level** (`/reports/risks_open_by_team.php`): risks grouped by team, then by level.
- **All Open Risks Assigned to Me** (`/reports/my_open.php`): the open risks assigned to you.
- **High Risk Report** (`/reports/high.php`): High and Very High risks.
- **Dynamic Risk Report** (`/reports/dynamic_risk_report.php`): a configurable report for ad-hoc questions.
See [The Built-In Reports](https://support.simplerisk.com/kb/08-02-the-built-in-reports?hsLang=en) for the full library.
### 10. For programmatic search, use the v2 API
For automation and integrations, the v2 API exposes filtered list endpoints across most record types:
- `GET /api/v2/risks` (with query parameters for filtering)
- `GET /api/v2/assets`
- `GET /api/v2/governance/frameworks`
- `GET /api/v2/compliance/...` for compliance records
- `GET /api/v2/im/incident/get/all` for incidents
- `GET /api/v2/exceptions/...` for document exceptions
With the Advanced Search Extra active, `GET /api/v2/advanced_search/results` runs the same cross-type search the Search page uses, with the same permission and team filtering. For a recurring "find all X matching Y" job, the API is the better path than repeating the search by hand.
## Common pitfalls
- **Looking for a search-everything box in Core.** It isn't there. Core searches one list at a time; the topbar search comes with the Advanced Search Extra.
- **Searching the wrong list.** Per-table search covers the table you're on and nothing else. A closed risk won't turn up in **Review Risk**, because that queue only holds risks that need attention. If a table search returns nothing, check which list you're on, and its filters, before you conclude the record doesn't exist.
- **Typing a whole sentence.** Search looks for what you typed as one piece of text, word for word, so a longer query matches fewer records. "Phishing attacks against finance staff" misses a risk titled "Finance team phishing exposure"; "phishing" finds it. Start with the one or two most distinctive words and add more only if the results are too broad.
- **Ignoring "Results may be incomplete."** It's tempting to read the first page and move on, but the note means the search didn't read everything. Narrow the query until it goes away before you conclude a record isn't there.
- **Forgetting that results are filtered.** Search returns only records your role can open, and with team separation on, only records your teams can see. Two people running the same query can get different counts, and both are correct. If something you expect is missing, check your permissions and teams before you report a bug.
- **Not clearing the control search after a deep link.** A control result opens **Define Control Frameworks** with that control's number in the table's search box. The table stays narrowed until you clear it, which can look like the framework has lost its other controls.
- **Searching when navigating would be faster.** If you want "the SOC 2 framework," **Governance → Define Control Frameworks** puts it in the framework rail in two clicks. Search is best for "find this specific record," navigation for "go to this section."
## Related
- [Navigating the UI](https://support.simplerisk.com/kb/09-01-navigating-the-ui?hsLang=en)
- [Favorites and Personalization](https://support.simplerisk.com/kb/09-03-favorites-and-personalization?hsLang=en)
- [The Built-In Reports](https://support.simplerisk.com/kb/08-02-the-built-in-reports?hsLang=en)
- [What Makes a Good GRC Report?](https://support.simplerisk.com/kb/08-01-what-makes-a-good-grc-report?hsLang=en)
- [Permission Reference](https://support.simplerisk.com/kb/03-03-permission-reference?hsLang=en)
- [FAQs](https://support.simplerisk.com/kb/faqs?hsLang=en)
- [SimpleRisk Extras](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#main-content)
- [Vulnerability Management Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#vulnerability-management-extra)
- [Team Separation Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#team-separation-extra)
- [Import-Export Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#import-export-extra)
- [Administrator Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#main-content)
- [00 About This Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#00-about-this-guide)
- [01 Installation and Deployment](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#01-installation-and-deployment)
- [02 Upgrades and Maintenance](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#02-upgrades-and-maintenance)
- [03 Users and Permissions](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#03-users-and-permissions)
- [04 Authentication](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#04-authentication)
- [05 Customization](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#05-customization)
- [06 Configuring Risk and Compliance](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#06-configuring-risk-and-compliance)
- [07 Integrations](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#07-integrations)
- [08 The API](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#08-the-api)
- [09 Encryption and Data Security](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#09-encryption-and-data-security)
- [10 Workflows and Automation](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#10-workflows-and-automation)
- [11 Reporting and Auditing](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#11-reporting-and-auditing)
- [12 Operations](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#12-operations)
- [13 Reference](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#13-reference)
- [User Guide](https://support.simplerisk.com/kb/user-guide?hsLang=en#main-content)
- [00 Foundations of GRC](https://support.simplerisk.com/kb/user-guide?hsLang=en#00-foundations-of-grc)
- [01 Risk Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#01-risk-management)
- [02 Compliance Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#02-compliance-management)
- [03 Governance](https://support.simplerisk.com/kb/user-guide?hsLang=en#03-governance)
- [04 Asset and Data Inventory](https://support.simplerisk.com/kb/user-guide?hsLang=en#04-asset-and-data-inventory)
- [05 Threat and Vulnerability Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#05-threat-and-vulnerability-management)
- [06 Assessments](https://support.simplerisk.com/kb/user-guide?hsLang=en#06-assessments)
- [07 Incident Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#07-incident-management)
- [08 Audit and Reporting](https://support.simplerisk.com/kb/user-guide?hsLang=en#08-audit-and-reporting)
- [09 Day-to-Day SimpleRisk](https://support.simplerisk.com/kb/user-guide?hsLang=en#09-day-to-day-simplerisk)
- [10 Continuous Improvement](https://support.simplerisk.com/kb/user-guide?hsLang=en#10-continuous-improvement)
- [SimpleRisk User Guides](https://support.simplerisk.com/kb/simplerisk-user-guides?hsLang=en)
- [Troubleshooting](https://support.simplerisk.com/kb/troubleshooting?hsLang=en)
- [SimpleRisk Hosted](https://support.simplerisk.com/kb/simplerisk-hosted?hsLang=en)
- [How To videos](https://support.simplerisk.com/kb/how-to-videos?hsLang=en)
[](https://www.simplerisk.com)
Copyright © 2026, SimpleRisk, Inc.