# Identify a risk and assign its owner

> Start with Acme's supplier dependency and business objective rather than an unexplained risk score.

_Updated: 2026-10-07_

## Continue the Acme case

[Acme Workshops](/en/learn/core-company-setup) bought a **$6,000** machine to deliver a **$9,000** customer project. Accounting preserves the order, receipt, invoice and payment; [October close](/en/learn/accounting-close) does not independently assess supplier risk. GRC now examines the same project's evidence and history. Its review does not rewrite accounting transactions.

## Role and prerequisites

An installed GRC Product and Acme company membership are required. The risk owner prepares the business risk; the risk expert reviews its meaning and evidence; assigned independent authorities decide the required publication. Ownership comes from effective company assignments, not a name typed into a form.

## From objective to risk record

1. State the objective: deliver Beacon's project on time and preserve its expected margin. Link the permitted project and purchase evidence by their business references.
2. Separate **cause** (dependence on one equipment supplier), **event** (late delivery) and **consequence** (missed customer delivery and additional cost). Do not classify an already paid invoice itself as a risk event.
3. Record the responsible process, company scope, risk owner and supporting source. Use the current company and allowed owner choices. A missing owner is a governed organisation prerequisite.
4. Submit through the supported identification review. An expert may return an unclear cause or unsupported consequence for correction; retain the original record and reason.
5. After the required independent decision, reopen the accepted version and its owner assignment.

## Verify the saved result

One accepted risk describes Acme's supplier dependency, objective, accountable owner and exact evidence. An employee reporting a concern uses Core **Start process** and tracks their own submission; they do not gain the company risk register. Another company or an unassigned person must not see the dossier from a copied link.

Continue to [assessment with an approved method](/en/learn/grc-risk-assessment). The equipment cost is exposure context, not a default financial-loss score.