Any issue can be a risk
Use a Risk issue type if you have one, or any other. Rate likelihood and impact in the issue's Risk panel, before and after treatment.
Jira Cloud app
Riskworthy
A risk register any team can use in Jira. Rate likelihood and impact on any issue, see every risk on a heat map, and search them with JQL. No admin setup.
Riskworthy turns any Jira issue into a risk: assess it before and after treatment in its Risk panel, and it joins the project's register and heat map. The assignee owns the risk, linked issues are the treatment work, and overdue reviews stand out. Project admins choose the matrix; nobody needs global admin rights.
Heat map per project
The project's Risks page shows every risk on a likelihood by impact heat map. Click a cell to filter, or switch to residual risk.
Treatment you can see
Issues linked to a risk show next to it with their status, so the work that reduces a risk is never out of sight.
Searchable everywhere
JQL fields such as riskworthyScore and riskworthyBand work in filters, boards and other gadgets.
Your matrix, set by project admins
3×3, 4×4 or 5×5, your own level names and band thresholds. No global admin needed.
No personal data
Risk owners are the issues' assignees, so Riskworthy stores no names or account IDs, and calls nothing outside Atlassian.
Getting started
Riskworthy is not on the Atlassian Marketplace yet. These steps apply once it is listed.
- In Jira, open Apps → Explore more apps, search for Riskworthy and install it. You need to be a Jira admin to install apps.
- Open any issue you want to track as a risk. In the right-hand column, open Riskworthy and rate its likelihood and impact.
- Open the project's Risks tab (under More if it isn't shown) to see the register and heat map.
It works in company-managed, team-managed and service projects. Anyone who can edit an issue can assess it; anyone who can view it can see the assessment.
Assessing a risk
| Field | What it means |
|---|---|
| Likelihood and impact | Required. Levels use the project's names, for example 4 Likely and 5 Severe. Score = likelihood × impact. |
| Treatment | Reduce, accept, transfer or avoid, or not decided yet. |
| Controls and notes | What you do, or will do, about the risk. Up to 2,000 characters. |
| Residual likelihood and impact | Optional: the rating after treatment. Set both or neither. |
| Category | Optional, for example Information security. Up to 60 characters. |
| Next review | Optional. Past dates show as overdue in the panel, the register and the gadget. |
The risk's owner is the issue's assignee and its status is the issue's status, so your existing workflow and notifications keep working. To take an issue off the register, choose Remove in its Risk panel.
Scores and bands
Each score falls in a band. These are the defaults; project admins can change them.
| Matrix | Low | Medium | High | Critical |
|---|---|---|---|---|
| 5 × 5 | 1-4 | 5-9 | 10-14 | 15-25 |
| 4 × 4 | 1-3 | 4-7 | 8-11 | 12-16 |
| 3 × 3 | 1-2 | 3-5 | 6-8 | 9 |
The register and heat map
- The Risks tab lists every assessed issue in the project that you can view, sorted by key number (PROJ-9 before PROJ-10).
- The heat map shows how many risks sit in each cell. Click a cell to filter the table; click it again, or Show all, to clear. Switch between inherent and residual risk.
- Filter by band and by treatment.
- Export register (CSV) gives every column, with level names, owners, overdue reviews and linked issues. Cells that would start a spreadsheet formula are prefixed with an apostrophe, so the file is safe to open in Excel.
Searching with JQL
Assessments are indexed, so you can use them in Jira search, filters, boards and other gadgets:
| Field | Example |
|---|---|
| riskworthyScore | riskworthyScore >= 15 ORDER BY riskworthyScore DESC |
| riskworthyBand | riskworthyBand = critical |
| riskworthyResidualScore, riskworthyResidualBand | riskworthyResidualBand in (high, critical) |
| riskworthyTreatment | riskworthyTreatment = accept |
| riskworthyCategory | riskworthyCategory = "Information security" |
| riskworthyReviewDue | riskworthyReviewDue < now() (overdue reviews) |
| riskworthyAssessed | riskworthyAssessed = yes (every risk) |
A new or changed assessment appears in search within a few seconds.
Dashboard gadget
On any Jira dashboard choose Add gadget, search for Riskworthy heat map, then pick a project and whether to show inherent or residual risk. Add two to show both side by side.
Matrix settings
Project admins see Matrix settings on the Risks tab. Choose the matrix size, name each likelihood and impact level, and set the lowest score of each band.
- Saving updates the stored band on every existing risk, so JQL by band stays right.
- Making the matrix smaller keeps every value. Risks rated beyond the new size show Re-rate until someone edits them.
- Each project has its own settings. Projects that never change them use the 5 × 5 defaults.
Data and privacy
| What | Where it lives | Who can see it |
|---|---|---|
| Assessments: levels, scores, bands, treatment, controls, category, review date | On the Jira issue itself, as an issue property | People who can view the issue |
| Project matrix settings | Your Atlassian site's app storage (Forge storage) | People who can view the project |
- Riskworthy stores no personal data: no names, email addresses or account IDs. The owner shown is the issue's assignee, read from Jira when you look.
- It has no servers of its own and sends nothing outside Atlassian. It is built to qualify for Atlassian's Runs on Atlassian programme. Its logs record only error types and status codes.
- We, the vendor, cannot see your risks.
- Permissions it asks for: read and write Jira work items (to read issues and store assessments on them) and app storage (for matrix settings).
- Uninstalling leaves the assessments stored on your issues, but the Risk panel, the Risks tab and the JQL fields go away. Export the register first if you want a copy outside Jira.
See also our privacy policy.
Troubleshooting
| Message or problem | What to do |
|---|---|
| I can't find the Risk panel | In the issue's right-hand column, scroll to Riskworthy. In a narrow window it may be below Details and Automation. |
| I can't find the Risks tab | Open the project and look under More in the tabs at the top. |
| "You need permission to edit this issue" | Assessing or removing needs Jira's permission to edit that issue. Ask a project admin. |
| "Only project admins can change the risk matrix" | Ask someone with the Administer projects permission. |
| A risk I just assessed isn't in search results | Jira indexes it within a few seconds. Search again. |
| A risk shows Re-rate | Its levels are beyond the project's current matrix size. Edit the assessment in its Risk panel. |
| "Riskworthy's licence for this site isn't active" | The subscription or trial has ended. A Jira admin can renew it from the apps section of Atlassian Administration. Until then, assessments, the register, the gadget and the CSV export stay readable. |
Changelog
| Version | Date | Changes |
|---|---|---|
| 0.1.0 | 7 Nov 2026 | First version: Risk panel on any issue, Risks page with heat map, filters and CSV export, JQL fields, dashboard gadget, matrix settings for project admins. Not yet released. |
Support
Email office@smarteduonline.co.uk with the subject Riskworthy support. Please include:
- your Jira site address, for example
yourcompany.atlassian.net - the project key and, if it's about one risk, its issue key
- what you did, what you expected and what happened instead
- a screenshot of the Risk panel, the Risks tab or the message
Use of Riskworthy is covered by our terms of use and privacy policy.