Risk Management

A risk register that stays alive

Most risk registers are a spreadsheet written once for an audit and never reopened. Risk Management makes risk a running practice: every risk is owned, scored on a scale everyone reads the same way, given treatment with owners and dates, and reviewed on a cadence the system keeps for you. What you get back is not a document - it is the evidence of how you arrived at it.

• One register, consistently scored, so prioritising is a comparison rather than a guess
• Treatment actions and plans with owners, due dates and sign-off
• Reviews scheduled by risk level, so the register reflects today’s risks - not last year’s
• A full history of how each risk and its treatment changed over time

AI helps anyone run a proper assessment - and you stay in control

Risk work is usually gatekept by specialists: most people asked to complete a data-protection impact assessment do not know what half the questions mean. A built-in AI companion changes that - it explains each term in plain English with the standard it comes from, drafts a suggested answer from what you already know, and checks the assessment for gaps before you submit. When the assessment is approved, it proposes the risks the answers imply, each with its reasoning and the clause behind it, for your reviewer to accept, edit or reject.

And the maths stays yours. Every score in your register is calculated from values a person entered - AI can suggest a score and explain its thinking, but it never writes one, and no risk becomes active without someone confirming it. You get the speed of AI with the accountability a regulated decision needs.

Scoring you can defend

Risk Management ships with a fully calibrated 5×5 Likelihood × Impact model, grounded in NIST SP 800-30, so “why is this a four?” finally has a written answer. As you set likelihood and impact, the score, its band and colour, and the treatment expected all appear at once - the assessor sees the consequence before committing to it. Treatment is required above Medium and enforced when you save, and if a residual risk stays Medium or higher the product asks for the documented sign-off that accepting it requires - closing the gap that is the most common audit finding in risk management.

Need a different model? A methodology engine lets your administrator author your own scoring - multi-factor, weighted or highest-severity - version it and publish it out, so customising your scale and staying current are no longer a trade-off.

Never stale, always ready for the audit

Each risk carries a next-review date set by its band - Critical and High monthly, Medium quarterly, Low annually - and the owner is chased when it falls due. Even a “nothing changed” review counts: it resets the clock and leaves documented evidence that you looked. Assessments become a repeatable, dated, signed-off exercise - the person who fills one in cannot approve it, and once approved it is sealed and kept for good. When an auditor asks how you identified your risks and who signed them off, the Acceptance Log and the assessment record already hold the answer.