# Question - Possibility to create risk from findings, assessments etc
**URL:** https://discussions.eramba.org/t/question-possibility-to-create-risk-from-findings-assessments-etc/3412
**Category:** Forum - Software
**Tags:** question
**Created:** [August 2, 2023, 3:41pm UTC](https://discussions.eramba.org/t/question-possibility-to-create-risk-from-findings-assessments-etc/3412 "2023-08-02T15:41:26Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@d0zer](https://discussions.eramba.org/u/d0zer)
#### Post date: [August 2, 2023, 3:41pm UTC](https://discussions.eramba.org/t/question-possibility-to-create-risk-from-findings-assessments-etc/3412/1 "2023-08-02T15:41:27Z")
Hello dear community,
as i am lookint into eramba online demo, i have identified a topic i would like to ask you about.
Is it possible to create a risk from a finding, assessment, analysis etc.?
Or is the only way to create a risk from the risk module and have no link to a finding or assessment as source for the risk?
thanks in advance, best regards
---
### Author:  [@david.schroth](https://discussions.eramba.org/u/david.schroth)
#### Post date: [August 2, 2023, 10:06pm UTC](https://discussions.eramba.org/t/question-possibility-to-create-risk-from-findings-assessments-etc/3412/2 "2023-08-02T22:06:59Z")
Well, that’s not exactly how risks work in the GRC space. I usually see technical security folks define a finding as a risk, but in the GRC world it’s not that simple. Risks do not go away when they are “fixed” - they continue to exist, but just happen to have a lower residual/post treatment risk level to the organization.
Take a look at the problems vs solutions chapter and video in the compliance management module - this will help get your frame of thinking aligned.
In short, a risk is a problem, a compliance requirement (that you’re audited against) is a problem. A solution is a control or policy. If a set of “solutions” are not sufficient (by design, or because they do not work) to to satisfy a problem, that itself is not a new risk, but either a risk that has a residual risk that is greater than the acceptance threshold or a compliance requirement that is not achieved.
Note that risk and compliance package items are somewhat mutually exclusive as they are two different types of problems - yes, you may have a risk identified about not meeting compliance requirements, but not necessarily a risk about every single compliance item…
Hopefully this isn’t too abstract…
---
### Author:  [@kisero](https://discussions.eramba.org/u/kisero)
#### Post date: [August 3, 2023, 7:09am UTC](https://discussions.eramba.org/t/question-possibility-to-create-risk-from-findings-assessments-etc/3412/3 "2023-08-03T07:09:42Z")
> [@d0zer](#):
>
> as i am lookint into eramba online demo, i have identified a topic i would like to ask you about.
> Is it possible to create a risk from a finding, assessment, analysis etc.?
you might want to review online assessment feature.
> **[Send Questionnaires to Vendors and Staff](https://www.eramba.org/learning/courses/81)**
>
> Upload any questionnaire, send it to suppliers or colleagues, and turn their answers into risks and findings. Third-party assessments in eramba.
you can create risk questionaires and those can be used as input to your risk analysis