Platform
One record, and what links to it
There is one record for each risk and everything else links to it: the controls that mitigate it, the assessments of both on a cycle, the indicators (KRIs) scored against its appetite, the breach raised when a value goes red, the remediation that follows and the committee pack that is assembled from all of it.
A risk can have many controls and many indicators. What matters is that every one is linked back to the risk it belongs to, and that every change to any of them is written to the audit trail as it happens.
The risk manager's dashboard, drawn from the platform. Each part of it has a page of its own below.
The governance core, part by part
The core is complete on its own, and every change to it is written down where an auditor can see it.
The risk register
Every risk carries its owner, its appetite and the reasoning behind both, and the platform works out the score rather than asking somebody to type it. Owners reassess each risk on a cycle, and the second line reviews what moved.
Controls
One control can cover four risks and be maintained once. Owners assess it on a cycle, the second line reviews the result and every assessment carries a date and an assessor.
Indicators
A value scores the moment somebody enters it. Nobody waits for a workbook to be consolidated to find out that a number went red.
Threshold breaches
A value that crosses red raises a formal record the day it happens, and the person who produced the number cannot write the response to it.
Remediation
Actions arrive from breaches, risk events, control failures and quality findings, each linked back to its cause, and closed means that two people agreed it was.
Committee reporting
The pack assembles from live data, and every figure traces back to source.
Audit trail and quality checks
Every change writes who, what, from what to what, when and in what role, and nothing edits or deletes it. A fixed set of rules checks the register overnight.
Group and multi-entity structure
The risk is written once, each entity carries its own residual, owner and thresholds and the centre gets one consolidated picture.
Who sees what
Five roles, each with a screen of its own: the risk manager's dashboard, the indicator owner's own updates, the compliance officer's approval queue, the board's exception view and a read-only view for an auditor with nothing editable. A role can cover one entity or all of them, and anything outside it is refused.
Nobody grants themselves a role, deactivates their own account or resets their own second factor. Our own staff sign in separately, to set up your environment and deal with support, and cannot read your register, controls, indicators or committee packs.
Read it as a story
One risk, end to end
The parts above are easier to judge in use, so we have written up one risk from the register to the committee pack: the control that mitigates it, the indicator scored against its appetite, the breach raised when a value goes red, the remediation and the pack, with the audit trail written at each step.
Prefer the screens? The platform, screen by screen. Prefer the pack? One committee pack, end to end.