Shopify Flow: Start a Risk-Review Workflow After Order Risk Is Analyzed

Use Shopify Flow's Order risk analyzed trigger when the workflow should begin after Shopify completes its risk assessment. A workflow started at order creation can run before that information is ready. For a monitoring task, route the resulting order context for merchant review and leave fulfillment, cancellation and customer communication decisions outside this workflow.

The trigger and field guidance below were reviewed on 6 September 2026. The workflow is an illustrative setup, not a claim that it was activated or tested in a live Shopify store.

Choose the trigger for the timing you need

Shopify states that Order risk analyzed runs after Shopify fraud analysis completes and does not trigger for third-party assessments. It is therefore a specific timing signal, not a universal notification that every possible risk provider has finished.

Create a new workflow in Shopify Flow and choose this trigger by its documented name. Give the workflow a purpose-based name such as “Route analyzed orders for merchant risk review.”

Do not use an arbitrary delay after order creation as proof that analysis has completed. Processing timing can vary, and a delay describes elapsed time rather than a completed source event.

If your business needs updates from a third-party assessment, investigate that provider's supported event route separately. The Shopify trigger should not be represented as covering a source it does not announce.

Select a narrow review condition

The GraphQL OrderRiskSummary separates the overall recommendation from individual assessments. In Flow, use the current variable picker to select the supported order-risk field and inspect the value available to the workflow.

For this illustrative review workflow, select the order risk recommendation and use an OR condition: the recommendation equals INVESTIGATE, or it equals CANCEL. Both branches route a review marker; neither executes the recommended commercial action. Verify the field path exposed in your current Flow editor rather than typing a guessed legacy risk-score field from an old tutorial.

Shopify documents recommendation values in the risk recommendation reference. A recommendation is information for the merchant's process, not proof that the merchant has already made or executed the corresponding decision.

If the field is unavailable, keep an explicit exception branch or record the run for investigation. An absent recommendation should not silently become an approval condition.

Build a review-only action path

A simple native action is to add an order tag such as risk-review-requested when the chosen condition is met. The tag marks a review need; it does not state that the order is fraudulent or that the case has been decided.

Use this configuration worksheet:

If you add an internal notification through an available authorized action, include only the information needed to find the order and understand why review was requested. Sending an HTTP request to a merchant-controlled endpoint is a separate implementation covered in the dedicated guide.

Do not attach cancellation, payment capture or fulfillment actions merely because the trigger makes them available. This workflow's purpose is to route review after analysis.

Work through a hypothetical order

A hypothetical order is placed and Shopify's assessment finishes later. The trigger runs, the workflow reads the available recommendation and adds the review marker under the selected condition.

An operator opens the order, reviews the recommendation and individual signals, and records the merchant's decision through the business's separate process. The review marker is not evidence that this decision has already occurred.

Now suppose a third-party app later adds an assessment. The original Shopify trigger does not establish that this new assessment generated another run. If the merchant needs to react to that change, it must use the provider's supported route or another documented Shopify event appropriate to that requirement.

The example shows the importance of naming the workflow accurately. “After Shopify risk analysis” is a verifiable scope. “After all fraud checks” is broader than the trigger supports.

Verify timing and branch behavior

Shopify's trigger guide describes testing with an order that triggers Shopify fraud analysis. Use the supported test approach in an appropriate store environment and inspect Flow's run details. Do not assume that every synthetic or test payment produces the same risk-analysis behavior.

Check the trigger time, condition value and action result. Exercise a review condition, a condition that does not request review and a missing or unexpected value where the test method permits it.

Also verify repeated handling. Adding the same review tag should not create a growing set of duplicate task records elsewhere. If another system creates tasks, give that handoff its own identity and repeat-delivery policy.

Keep the merchant decision visible

Document who monitors the review queue and how completed reviews are recorded. A tag can route work, but it does not assign accountability by itself.

Review the workflow when you change risk providers or the fields used by the condition. Preserve the distinction between Shopify's recommendation, a provider assessment and the merchant's actual decision.

The completed workflow should do one clear job: wait for the documented Shopify analysis event, evaluate supported operational context and route the order for review. That timing makes the review more useful without turning an informational trigger into an automatic commercial decision.

Explore merchant-controlled order-risk review in Lower Chargeback.

Explore Risk Review

Related reading in this collection:

• Query Shopify Payments Disputes With GraphQL: A Monitoring-Only Example
• Shopify Flow Send HTTP Request: Connect a Risk Notification to Your Own Endpoint
• Shopify Dispute Monitoring Permissions: Request Only the Scopes You Need