Risk Management

Scoped assessments that produce risk scenarios against the matrix you chose, attached to a perimeter from Governance.

Scenarios beat one-line risk titles. An assessment records the threat, the asset and the consequence, so two people reading the register understand the same thing.

Three by three, four by four and five by five matrices, configurable per tenant, with named levels and colour bands you define.

Your methodology is already approved by your own risk committee. The platform adapts to it rather than asking you to re-approve a vendor default.

Three scores for each risk: inherent, controlled and residual. An explicit manual-override path lets an owner disagree with the calculated score on the record.

Residual risk that nobody can explain is worthless in a board pack. Here the number has a derivation, and a disagreement with it is itself recorded rather than argued in email.

The canonical list: owner, category, scenario, all three scores, treatment status and a stable risk identifier.

One register, one ID. When Audit raises a finding against a risk, it points at the same record Risk is managing.

Treatments with milestones, progress logs, attached evidence items, success criteria and scheduled stakeholder review.

A treatment without a success criterion never closes. Writing down what "done" means at the start is what makes the register shrink.

Formal acceptance through an approval workflow with segregation-of-duties enforcement, governed by an acceptance matrix that defines who may accept what.

Accepting a risk is a decision with a name on it. The matrix stops a risk owner quietly accepting an exposure above their authority.

Set appetite per risk category. Breaches surface automatically rather than waiting for someone to notice them.

Appetite that lives in a board minute changes nothing. Appetite encoded as a threshold changes what the register shows you on a Monday morning.

KRIs tracked against defined thresholds, so movement in an indicator is visible before it becomes movement in a score.

A risk score is a lagging view. An indicator moving in the wrong direction is the earliest warning you get.

The board view of the register, plotted on your matrix, with above-appetite cells called out.

It is the one artefact a board actually reads. Making it a live view of the register instead of a rebuilt slide removes a whole reporting cycle.

Record insurance and contractual transfer against a risk, with its cost and coverage amount.

Transfer is a treatment option like any other. Keeping it in the register stops the insurance conversation happening somewhere the risk team cannot see.

Risk level history, trend over time, and top exposures, scoped to whichever folder you are looking at.

The question is never only "what is our exposure" but "which way is it moving". Trend answers the second one.