---
title: "Update organization risk"
method: PATCH
path: "/v1/risks/{id}"
tags: ["Risks"]
---

# Update organization risk

`PATCH /v1/risks/{id}`

Update a risk record as mitigation work progresses so compliance reports reflect the current risk posture.

## Path parameters

- `id` string, required

## Request body

- UpdateRiskDto
  - `title` string — Risk title
  - `description` string — Detailed description of the risk
  - `category` 'customer' | 'fraud' | 'governance' | 'operations' | 'other' | 'people' | 'regulatory' | 'reporting' | 'resilience' | 'technology' | 'vendor_management' — Risk category
  - `department` string — Department responsible for the risk. Built-in values: none, admin, gov, hr, it, itsm, qms. Custom department names are also accepted.
  - `status` 'open' | 'pending' | 'closed' | 'archived' — Current status of the risk
  - `likelihood` 'very_unlikely' | 'unlikely' | 'possible' | 'likely' | 'very_likely' — Likelihood of the risk occurring
  - `impact` 'insignificant' | 'minor' | 'moderate' | 'major' | 'severe' — Impact if the risk materializes
  - `residualLikelihood` 'very_unlikely' | 'unlikely' | 'possible' | 'likely' | 'very_likely' — Residual likelihood after treatment
  - `residualImpact` 'insignificant' | 'minor' | 'moderate' | 'major' | 'severe' — Residual impact after treatment
  - `treatmentStrategyDescription` string — Description of the treatment strategy
  - `treatmentStrategy` 'accept' | 'avoid' | 'mitigate' | 'transfer' — Risk treatment strategy
  - `assigneeId` string — ID of the user assigned to this risk

## Response `200`

Risk updated successfully

- object
  - `id` string — Risk ID
  - `title` string — Risk title
  - `description` string — Risk description
  - `category` 'customer' | 'governance' | 'operations' | 'other' | 'people' | 'regulatory' | 'reporting' | 'resilience' | 'technology' | 'vendor_management'
  - `department` 'none' | 'admin' | 'gov' | 'hr' | 'it' | 'itsm' | 'qms', nullable
  - `status` 'open' | 'pending' | 'closed' | 'archived'
  - `likelihood` 'very_unlikely' | 'unlikely' | 'possible' | 'likely' | 'very_likely'
  - `impact` 'insignificant' | 'minor' | 'moderate' | 'major' | 'severe'
  - `residualLikelihood` 'very_unlikely' | 'unlikely' | 'possible' | 'likely' | 'very_likely'
  - `residualImpact` 'insignificant' | 'minor' | 'moderate' | 'major' | 'severe'
  - `treatmentStrategyDescription` string, nullable
  - `treatmentStrategy` 'accept' | 'avoid' | 'mitigate' | 'transfer'
  - `organizationId` string
  - `assigneeId` string, nullable — ID of the user assigned to this risk
  - `createdAt` string, date-time — When the risk was created
  - `updatedAt` string, date-time — When the risk was last updated
  - `authType` 'api-key' | 'session' — How the request was authenticated
  - `authenticatedUser` object — User information (only for session auth)
    - `id` string
    - `email` string

## Other responses

- `400` — Bad request - Invalid input data
- `401` — Unauthorized - Invalid authentication or insufficient permissions
- `404` — Risk not found
- `500` — Internal server error

---

[API](https://skmtc.net/trycompai/apis/comp-ai-api.md) · [All operations](https://skmtc.net/trycompai/apis/comp-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/trycompai/comp-ai-api/revisions/726b9523fb22/schema)