By role · Risk Manager
Risk as a strategy, not a checkbox.
Spreadsheet registers miss the connections. Set the scoring methodology once, then let every entry hold the controls, processes, incidents, KRIs and vulnerabilities it actually touches, with treatment plans and formal acceptances on the record.
What this replaces
- Between audits, the register sits closed.
- Two people score the same threat and neither can show the working.
- Mitigation gets tracked in a second spreadsheet with no owner on it.
What you do here
- 1Set the scoring methodology once.Likelihood, impact and appetite live on one screen. Every entry in the register scores against the same definitions.Risk parameters
- 2Move a risk through the edit wizard.Inherent score, treatment, owner and residual score change in one pass. The register never holds half an update.Risk edit wizard
- 3Link a risk five ways.Controls, business processes, incidents, KRIs and vulnerabilities hang off the entry — the blast radius is on the page.Risk detail
- 4Track treatment to a date.Each plan names an owner and a target date, attached to the risk it is meant to reduce.Treatment plans
- 5Record a formal acceptance.The decision, the person who made it and the date attach to the risk, ready to produce a year later.Risk register
- 6Read the Bow-Tie analysis.Causes on the left, consequences on the right, your controls in the middle: one picture per risk.Risk analytics
What changes
- Five link types turn one register row into a map of what it touches.
- One methodology, one appetite: January's score means the same thing in November.
- An accepted risk shows a name and a date, not a colour.
Risk registerRisk parametersTreatment plansBow-Tie analysisRisk acceptanceRelationship graphRisk quantification
Where the role stops
You score assets and vulnerabilities without fixing them: both are read-only here. The register is yours; the control library and the evidence behind it are not.
Works with
- CISOFour teams, four numbers, one board meeting. Here the board pack, the maturity grade, the budget line and the permission matrix all read off the data your team already works in.STRATEGY
- Compliance OfficerMap one control to several frameworks, take the audit cycle from scope to certificate upload, then close each finding against a verify step instead of an opinion.COMPLIANCE
- Business Continuity ManagerProcess owners who never log in still have to answer the impact questionnaire. Scope the BIA as a campaign, author the plans behind it, then test them on a schedule with findings attached to every run.BCDRP
Ready to move
beyond legacy GRC?
14-day free trial. No credit card. Cloud or on-premises.