After plan/scope validation (during the assessment stage) in SAS^® OpRisk Monitor, if you create two or more risks with the same Risk Event Type for the same assessor of a form-based assessment, the scores for those risks should be pushed to the risk profile. However, most of the scores for those risks will not be pushed to the risk profile. Instead, only one score, or no scores, for the risks will be pushed. The problem also applies to risk copies that are created because the assessor edited the risk.

The problem occurs when you perform the following steps:

1. Create a form-based risk assessment, fill in all required fields, add one assessor and one risk, validate plan/scope.
2. On the assessment page (table of risks), create two new risks with the same Risk Event Type as the old risk and rate them, rate the previously selected risk, and sign off.
3. Send the assessment for accept/respond. Respond to risks, send for validation, and validate.
4. Look at these two risks in the risk profile. The "old" risk will have all scores pushed, but the new risk will have only one score pushed (or no scores at all).

To avoid the problem, do one of the following:

• Do not create more than one risk during the assessment stage. This also means that you should not edit more than one risk during the assessment stage. You can still create risks during plan/scope.
• Do not assign more than one of the new risks to the same assessor.
• Ensure that the new risks do not have the same Risk Event Type.

Click the Hot Fix tab in this note to access the hot fix for this issue.

Operating System and Release Information

A fix for this issue for SAS OpRisk Monitor 4.1_M2 is available at:

A fix for this issue for SAS OpRisk Monitor 4.1_M3 is available at: