Risk Bowtie CSV Import

Risk Bowtie CSV Import

How to build complete bowtie risks in bulk from a CSV file

Contents

• 1. Introduction & Context
• 2. Key Features & Functions
• 3. Requirements
• 4. Step-by-Step Guide
  • Download the template
  • Understand the file layout
  • How rows build a bowtie
  • Add risk ratings
  • Add your own columns
  • Upload and import the file
• 5. Common Issues & Troubleshooting
• 6. Related Articles

1. Introduction & Context

The Risk Bowtie CSV Import lets you create complete bowtie risks in bulk from a spreadsheet, so you can move a workshop output or an existing register into Clew in one upload instead of building each risk by hand.

A bowtie sets out a risk with its causes on one side and its consequences on the other. Preventing controls sit under each cause, mitigating controls sit under each consequence, and actions sit against the risk itself. The import builds all of that in a single pass: the risk, its causes, its preventing controls, its consequences, its mitigating controls, its actions, and its ratings.

Who is it for? Risk owners, risk coordinators, and system administrators who need to load a number of risks at once, for example after a risk workshop, during an initial data migration, or when adopting a new register.

What does it impact? The import creates new risk records and everything attached to them. It runs as a single all-or-nothing operation, so either every row in the file is valid and all of the risks are created, or nothing is created at all.

2. Key Features & Functions

• Builds the full bowtie in one upload: risk, causes, preventing controls, consequences, mitigating controls, actions, and ratings all come from the same file.
• Creates new risks only: there is no update mode. Existing risks are never changed by this import.
• Template download: you can download a ready-made template, either empty with sample rows to overwrite, or pre-filled with risks you have selected.
• Structure comes from the columns, not the layout: the import works out what each row means from which columns have a value in it, so you do not need to indent or group anything.
• Not limited to the template columns: you can add a column for any active field on a risk, an action, or a control. Custom fields can be imported on the risk itself.
• Date format control: dates are detected automatically, or you can set the format yourself before uploading.
• All-or-nothing import: one bad row stops the whole file, so you never end up with a half-loaded register.
• Full error report: if the import fails, you get a table listing every error with its row, its column, and a message, so you can fix them all before re-uploading.

3. Requirements

Both of the following must be true before you can use the import. If either is missing, the import is blocked before your file is read.

• The feature is switched on for your team. An administrator enables Enable Risk Bowtie CSV Imports in your team's admin settings. It is switched off by default.
• You have permission to create risks. If you cannot create a risk manually, you cannot create one through the import.
• A CSV file. A comma separated values file, saved from any spreadsheet application. A plain text file with commas between the values also works.

There is no single fixed list of required columns that applies to everyone. Which fields are required depends on how your organisation has configured risks, including any custom fields and custom risk types. Title is always needed, because it is the column that starts each risk.

4. Step-by-Step Guide

Download the template

Always start from a fresh template. It carries the exact column names the system reads, which saves you from the most common import errors.

1. Open your risk list view, or open a single risk.
2. Open the menu that holds the CSV and PDF export options. The import options sit in the same menu.
3. Click Download Template.
4. If you had risks selected when you downloaded, those risks are already filled in and you can use them as a worked example. If nothing was selected, the file contains sample rows that you can overwrite.

The risk list view with the export and import menu open, showing the Download Template and Import options.

Understand the file layout

The template has two header rows before your data begins.

• Row 1 is the label row. It holds plain-language names such as Preventing Controls - Title. It is there to help you read the file. The system ignores the wording, so you can change it if it helps your team.
• Row 2 is the mapping row. It holds the exact column names the system reads, such as preventing_control.title. Do not edit, rename, or reorder this row.
• Row 3 onwards is your data.

Two more rules apply to the cells themselves:

• Multiple values in one cell: where a field accepts more than one value, such as tags, start a new line inside the cell for each value. Do not separate them with commas.
• Dates: leave the date format on Automatic detection, or choose DD/MM/YYYY, MM/DD/YYYY, or YYYY-MM-DD at upload time if your dates are not being read correctly.

The downloaded template opened in a spreadsheet, showing the label row, the mapping row, and the first data row.

How rows build a bowtie

This is the part worth getting right. The import reads your file from top to bottom and works out what each row means from which columns have a value in it. Indenting, grouping, colouring, or blank rows make no difference.

• A value in Title starts a new risk. Every row below it belongs to that risk until the next Title value appears.
• A value in Cause - Title starts a new cause under the current risk.
• A value in Preventing Controls - Title adds a preventing control under the cause above it. Several of these rows in a row, with no new cause in between, add several controls to the same cause.
• A value in Consequence - Title starts a new consequence under the current risk.
• A value in Mitigating Controls - Title adds a mitigating control under the consequence above it, in the same way preventing controls attach to a cause.
• A value in Actions - Title adds an action to the risk itself, not to a particular cause or consequence.

Worked example. Reading the rows below in order builds one complete bowtie, then starts a second risk:

Add risk ratings

Each rating type has its own set of columns, for example one set for Inherent and another for Residual. Fill in the set that matches the rating you want to create.

• Required for each rating: a likelihood, a severity, and a severity category.
• Optional for each rating: a description, an alternative description, and an exposure value.

Add your own columns

The template only includes a starter set of columns, such as title, owner, and owner role. You are not limited to those. You can add a column for any active field that exists on a risk, an action, or a control in your system, as long as you write the name in the mapping row in the correct format.

Upload and import the file

1. Save your completed spreadsheet as a CSV file.
2. Go back to the risk list view and open the same menu that holds the export options.
3. Choose the import option and select your file.
4. Leave the date format on Automatic detection, or choose the format your dates are written in.
5. Click Import.

The import does not finish instantly. The page shows a processing state and updates itself every few seconds, so stay on the page until it reports a result.

• If it succeeds: you see a list of the risks that were created, with a link back to the risk list view.
• If it fails: you see a count of the errors and a table of every error with its row, its column, and a message. No risks are created.

The import screen with a file selected and the date format options shown.

5. Common Issues & Troubleshooting

The error table tells you the row and the column for every problem. Work through the list below to interpret each message.

Best practices:

• Start every import from a freshly downloaded template rather than an old copy, so the mapping row always matches your current configuration.
• Never edit or reorder row 2. Change the labels in row 1 instead if you want friendlier column names.
• Write each bowtie in order: the risk, then a cause with its preventing controls, then a consequence with its mitigating controls, then any actions.
• Test with one or two risks before uploading a large file. It is much faster to find a column problem in a small file.
• Keep your working spreadsheet, not just the CSV, so you can correct errors and export a new CSV quickly.
• Check whether a risk already exists before you import it. The import always creates new risks, so re-importing a file produces duplicates.
• If you are importing a custom risk type, confirm the required fields and custom field keys with your administrator first.

6. Related Articles