Risk management
A risk register people actually contribute to.
Risk register
Inherent and residual scoring, treatments, owners, review dates and links to the controls, assets and incidents a risk touches. Commenting is separate from editing, so the people closest to a risk can contribute without being able to change it.
Key capabilities
- Configurable risk matrix and scoring model
- Inherent and residual scores with treatment tracking
- A risk taxonomy your organisation defines
- Links to controls, assets, incidents, vendors and findings
- Scheduled review cycles with reminders
Describe it, and the form fills itself
The person who noticed the problem has a sentence, not a taxonomy. Type what happened in plain words and the fields are proposed for you: category, ratings, department. Nothing is saved. Every field stays editable, because the person who submits is the author of record.
Key capabilities
- Plain-language description turned into a structured draft
- Available on both the risk and incident registers
- Create only, never on an edit
- Stops at a likely duplicate and shows why it matched
Risk appetite and acceptance
Define an appetite with an approval threshold. A residual score above it turns acceptance into a governed act: recorded, approved, and never approved by the person who recorded it. Acceptances expire, so a decision made two years ago does not quietly remain your position.
Key capabilities
- Risk appetite with an approval threshold
- Acceptance recorded against a person, with an expiry date
- Separation of duties enforced on approval
- Appetite posture: how much of the register sits outside it
Quantification
Quantify a risk in financial terms and run Monte Carlo simulation over the distribution rather than arguing about a single point estimate. The output is a range with a confidence profile, which is what a finance audience can act on.
Key capabilities
- Financial quantification alongside qualitative scoring
- Monte Carlo simulation over loss distributions
- Quantification summary rolled into board reporting
Escalation paths
Define escalation paths once and have risks, incidents and findings follow them. A severity matrix decides which path applies, and a stalled item moves without somebody remembering to chase it.
Key capabilities
- Paths with ordered recipients and time thresholds
- Severity matrix mapping a rating to a path
- Automatic escalation on age or inactivity
- Raising an escalation separated from configuring the paths
Proof point
It stops at a duplicate. When something close already exists, the matches are shown with the words that produced them and no field is touched. Drafting a new one anyway is a second, deliberate click.
Questions about this
What should a risk register contain?
Each risk with owner, likelihood, impact, treatment, review date and the controls that treat it. Auditors look for it first.
What is Monte Carlo risk analysis?
A quantitative method that simulates thousands of scenarios to estimate a range of financial loss from a risk, giving the board a number instead of a colour.
How are risks linked to controls?
Every control traces back to the risks it treats, so a failed control shows which risks are exposed and a new risk shows which controls apply.
How often should risks be reviewed?
At least annually and on any significant change, with the review recorded. ISO 27001 requires it; SOC 2 auditors expect it.
Keep reading
Guide
ISO 27001 certification guide
Read the guide →
Article
What is GRC?
Read the article →
Product
Continuous monitoring
See the module →