One of our customers asked this great question:
"After I find and want to document a risk, I would like to say that the risk is going to be mitigated by the team, but would require say these three linked stories. How could I engineer it to say that this is accepted as mitigated, but not fully mitigated?"
In essence, we need two things:
a) a way to express the implementation of our treatment plan; and
b) a way to express the completion of our treatment plan.
We'll start by adding a new step to our Risk Workflow. Let's call it TREATMENT COMPLETE, and create a 'COMPLETE' transition from TREATED --> TREATMENT COMPLETE.
We need to edit the 'COMPLETE' transition, adding a conditon to it that will prevent the transition being made unless all sub-tasks are DONE.
There's such a condition built into JIRA, so all we have to do is choose it.
The parameters for the sub-task blocking condition should be set so that the 'DONE' step must be reached by all sub-tasks before the parent task can move through the 'COMPLETE' condition.
Don't forget to publish your workflow. The changes you've made will only be effective after your draft workflow has been published.
Now let's see how our workflow changes work in practice. Suppose I have a risk that I have analyzed and 'treated' (i.e. set the Treatment to 'Mitigate' and the Treatment Plan has been filled in). I can add sub-tasks to my risk to express the steps required to implement the treatment plan.
Our sub-tasks appear on the View Issue page, along with their statuses, so it's easy to see how far we are through our treatment plan.
Notice that there is no 'Complete' button on the screen, since one of our sub-tasks has yet to be 'Done'. Now let's mark that remaining task as 'Done'. You'll see that the 'Complete' button appears.
That's all there is to it. Let's review our solution with respect to our goals. We now have a way to distinguish between risks that have a treatment plan, and risks where that plan has been fully implemented. The latter will be in the 'TREATMENT COMPLETE' step.
If we want to, we can create a search filter that shows only risks in the TREATED and TREATMENT COMPLETE statuses: