Risk management software
Risk management software that connects risks to your controls
A risk register on its own tells you what could go wrong. Certifyi links each risk to the controls that treat it, the assets it affects and the vendors it comes from, so you see the full picture.
Why risk management software matters
Spreadsheet-based risk registers break down once you have fifty risks, three editors and a board that wants a heatmap. Scores drift, versions multiply and nobody knows which copy was last reviewed. Dedicated risk management software solves this by giving every risk a single source of truth with scoring, ownership and a full audit trail.
What you get in Certifyi
Risk management in Certifyi is not a standalone module. It sits in the same workspace as your controls, evidence, vendors and policies.
- Risk register
- Each risk records its source, category, likelihood, impact, inherent score, treatment plan, residual score and review history. Every change is logged.
- Heatmaps and dashboards
- Risks plotted by likelihood and impact, with drill-down to the risk detail. Export for board reporting.
- Treatment linked to controls
- When a risk is mitigated, the treatment links to the controls that carry it out. When a control fails, you see which risks are exposed.
- Asset and vendor connections
- Link risks to the assets and vendors they affect. Vulnerability risks come from NVD matching on your asset register.
- Incident management
- When an incident happens, log it, triage it and link it to the risks and controls it involves. Track it to closure.
- Business continuity
- Business impact analysis and continuity planning sit beside your risks and assets, in the same workspace.
Connected risk
Risks that connect to everything else
Most risk management software treats the risk register as an island. In Certifyi, a risk links to the controls that mitigate it, the evidence behind those controls, the assets it affects and the vendor it comes from.
When something changes — a control falls out of date, a vendor fails an assessment, a vulnerability is found on an asset — you see the risk impact straight away.
- Each risk linked to the controls that treat it
- Controls linked to their evidence, with version history
- Assets in a register with lifecycle, classification and vulnerability matching
- Vendors assessed through a dedicated vendor portal
- Incidents logged, triaged and connected to risks and controls
Scoring
Consistent scoring across the organisation
Certifyi uses scales you define — qualitative or semi-quantitative — so likelihood and impact mean the same thing regardless of who fills in the assessment. Inherent and residual risk use the same method.
Treatment decisions, including risk acceptance, are logged with the name of the person who made them and the date. The board sees a clean heatmap; the auditor sees the full trail.
- Configurable likelihood and impact scales
- Inherent and residual risk on the same scoring method
- Risk categories: operational, strategic, compliance, financial, technical
- Scheduled reviews with overdue tracking
- Full audit trail on every change
Compliance context
Risk management inside your compliance programme
Risk management is a requirement in every major framework. ISO 27001 clause 6.1, SOC 2 CC3, HIPAA § 164.308(a)(1) and NIST CSF all require a risk assessment. In Certifyi the risk register is already inside the compliance workspace, so the evidence for "we manage risk" is the register itself.
- Compliance software: controls, evidence and audit in one workspace.
- GRC platform: governance, risk and compliance together.
- Vendor risk: the full vendor lifecycle with a vendor portal.
- Continuous monitoring: real-time control status.
Questions
Risk management software, answered
What is the difference between a risk register and risk management software?
A risk register is a list of risks. Risk management software is the system that runs the register: it links each risk to the controls that treat it, calculates residual risk after controls, tracks treatment plans with owners and deadlines, and reports risk posture to leadership. A spreadsheet can hold the list; it cannot do the rest.
How does risk management software help with ISO 27001?
ISO 27001 clause 6.1 requires a documented risk assessment and risk treatment process. Risk management software runs that process: it records the methodology, scores each risk, maps risks to Annex A controls, tracks treatment to completion, and produces the reports the auditor reviews at surveillance.
Can risk management software handle AI risks?
Yes, when it supports AI-specific risk criteria. ISO 42001 and the EU AI Act require organisations to assess harm to individuals and groups, not just to the organisation. The software should let you score algorithmic bias, safety and fairness alongside financial and reputational risk, and link AI risks to the AI system register.
See how Certifyi connects risk to your compliance programme
Book a demo and we will walk through the risk register, heatmaps and control linkage with your team.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them