Platform / Screen by screen

The platform, screen by screen

Screens drawn from the platform, in the order the work happens. Scroll, and each takes the place of the last.

The real thing is shown against your own structure on a walkthrough. A companion walk follows one risk through the same six records.

Screen 01 of 08

What needs doing today

The dashboard opens on what needs attention: the items awaiting action, the red indicators, the open breaches and the latest risk events, scoped to the entities the viewer looks after.

The platform, part by part

The platform, drawn: the risk manager dashboard with the navigation beside it A stylised view of the platform's dashboard. Down the left, the navigation: dashboard, risk register, risk assessments, controls, control assessments, KRI register, KRI collection, breaches, risk events, remediation, committee packs and audit log, then a modules group listing the five modules. Across the top, five figures: KRI completion, red KRIs, open breaches, overdue actions and risks scoring twelve or more. Beneath them, the items needing action, a residual heatmap of impact against likelihood, KRI collection by entity, the red KRIs and the latest risk events. Connected risk intelligence All entities (Group) Dashboard Risk register Risk assessments Controls Control assessments KRI register KRI collection Breaches Risk events Remediation Committee packs Audit log MODULES TPRM & Supplier DD Obligations Management ICARA Operational Resilience Customer Oversight Portal RMRisk manager Risk manager dashboard Q3 2026 · All entities Customise KRI completion75%272 of 364 Red KRIs16Remediation required Open breaches5Not yet closed Overdue actions3Past their target date Risks scoring 12 or more12Residual, this quarter Action required6 items BREACH Open third party issues unresolvedInvestment management · Opened 1 Jul · Awaiting response BREACH Post-migration defects openPlatform services · Opened 3 Jul · Awaiting response 1 KRI not submittedChase: the indicator owner Overdue: breaches not closed within 30 daysAction owner named · Due 31 Jul Risk heatmap (residual)All entities 5 1 risk 4 4 risks 7 risks 2 risks 3 4 risks 7 risks 2 risks 2 2 risks 2 risks 2 risks 1 1 2 3 4 5 KRI collection by entityOpen cycle Advisory92 of 92 Investment management75 of 92 Platform services56 of 92 Group49 of 88 Red KRIsView all REDComplaints upheld against receivedInvestment management · Owner named66.6% REDCritical patches applied within SLAPlatform services · Owner named71% REDBreaches not closed within 30 daysGroup · Owner named4 REDTrade debtors over 90 daysAdvisory · Owner named12% Risk eventsView all HighIncorrect order entryOperational risk6 Aug MediumReconciliation break over 24 hoursClient money29 Jul LowSupplier MI pack lateThird party risk14 Jul MediumAccess not removed on leavingInformation security2 Jul

Screen 02 of 08

The register, scored and owned

Every risk carries its owner, its appetite and the reasoning behind both, and the platform works out the score, so nobody types one in.

The risk register

The risk register: categories, scored risks with their sub-risks and where each sits against appetite A drawn view of the platform's risk register with the navigation beside it. Four figures across the top: total risks, risks outside appetite, risks unchanged for two or more quarters and quality flags. Beneath, the strategic category opened to show four risks, each with a computed score, its entity, a named owner and delegate, its sub-risks indented under it and a pill saying whether it is within or outside appetite. Connected risk intelligence All entities (Group) Dashboard Risk register Risk assessments Controls Control assessments KRI register KRI collection Breaches Risk events Remediation Committee packs Audit log MODULES TPRM & Supplier DD Obligations Management ICARA Operational Resilience Customer Oversight Portal RMRisk manager Risk register (33) 33 risks across 4 entities Add risk Total risks33 12 at 12 or more Outside appetite15 Stuck risks15 Unchanged for two quarters or more QA flags2 Owner below the level the rule expects Search risksAll entitiesAll scores Strategic7 risks3 outside 12Customer outcomesInvestment managementOwner named · Delegate named Outside 1.1 Suitability of advice 1.2 Product governance 12Group model riskInvestment managementOwner named · Delegate named Within 2.1 Revenue concentration 2.2 Strategic execution 2Regulatory relationshipAdvisoryOwner named · Delegate named Within 3.1 Notification timeliness 15Climate and sustainability disclosureInvestment managementOwner named · Delegate named Outside 4.1 Climate risk disclosure

Screen 03 of 08

One control, maintained once

One control can cover four risks and be maintained once. Design and operating effectiveness are assessed separately, and every assessment carries a date and an assessor.

Controls

A control in the library: its assessment history and the four risks it mitigates A drawn view of the platform. On the left, one control, daily client money reconciliation, with its type, frequency and owner, and three dated assessments beneath it, each rating design and operating effectiveness separately with the assessor's initials. On the right, the four risks the control mitigates, each with its residual score. Connected risk intelligence All entities (Group) Dashboard Risk register Risk assessments Controls Control assessments KRI register KRI collection Breaches Risk events Remediation Committee packs Audit log MODULES TPRM & Supplier DD Obligations Management ICARA Operational Resilience Customer Oversight Portal RMRisk manager Daily client money reconciliation KEY Control · detective · daily · owner named · next assessment due 30 Jun Record assessment Assessments Every one stays on the record DATEDESIGNOPERATINGASSESSOR 30 Mar Effective Effective RMsecond line 30 Dec Effective Partially effective COsecond line Two exceptions in the month, both cleared within a day. Remediation action raised and since closed. 30 Sep Effective Effective RMsecond line Design effectiveness Is it the right control for the risks it is meant to mitigate? Operating effectiveness Is it actually working, as at the date of the assessment? Assessed separately, because "the control works" is an opinion until it has a date and an assessor attached to it. Mitigates 4 risks 9 Client money reconciliation failsOperational · within appetite 6 Misposted transactionOperational · within appetite 6 Unauthorised transferConduct · within appetite 4 Late regulatory returnRegulatory · within appetite Maintained once. A change to this control reaches all four. A change to any of them writes to the audit trail.

Screen 04 of 08

A value that scores as it is entered

A value scores the moment it is entered, against that unit's own thresholds. A correction is a new version, and the earlier one stays.

Indicators

An indicator's trend over eight months beside its latest submission and versions A drawn view of the platform. On the left, a chart with red, amber and green bands and eight monthly values that fall from the red band into the green. On the right, the latest submission marked scored on entry, two versions of it with the reason for the correction and the thresholds that apply to this unit. Connected risk intelligence All entities (Group) Dashboard Risk register Risk assessments Controls Control assessments KRI register KRI collection Breaches Risk events Remediation Committee packs Audit log MODULES TPRM & Supplier DD Obligations Management ICARA Operational Resilience Customer Oversight Portal RMRisk manager Open complaints beyond target Indicator · monthly · lower is better · risk: complaints handling Unit A Green · Improving Trend Last eight months 16840 JanFebMarAprMayJunJulAug Bands are this unit's thresholds at the time each value was scored Latest submission 3 Green scored on entry Submitted by the indicator owner, 2 Sep 10:14 Owner for this unit: named · target 2 Version 2 of 2 Versions v2 · 3 · current Corrected from 5 on 3 Sep, reason recorded v1 · 5 · kept on the record, not overwritten This unit: green up to 4, amber up to 8, red above 8

Screen 05 of 08

A number crosses red, and a record opens

A value that crosses red raises a formal breach record the day it happens, and the person who produced the number cannot write the response to it.

Threshold breaches

The breaches list: every active breach with its source, entity, the value that crossed red, its status and when it opened A drawn view of the platform's breaches list with the navigation beside it. Filters across the top count the breaches that are active, open, in remediation, responded to and closed. A table lists five breaches: what raised each one (a value crossing a red threshold, a failed control or a breach raised by hand), the entity, the value against its threshold, a status pill and the date it opened. Connected risk intelligence All entities (Group) Dashboard Risk register Risk assessments Controls Control assessments KRI register KRI collection Breaches Risk events Remediation Committee packs Audit log MODULES TPRM & Supplier DD Obligations Management ICARA Operational Resilience Customer Oversight Portal RMRisk manager Breaches Active breaches, most urgent first. One with an open action shows as in remediation and cannot close until the action does. Raise breach Active (5) Open (2) In remediation (1) Responded (2) Closed (1) SOURCEENTITYVALUESTATUSOPENED Open third party issues unresolved Investment managementValue 22 against a red threshold of 10Open1 JulView Post-migration defects open Platform servicesValue 17 against a red threshold of 15Open3 JulView Daily client money reconciliation not completed Control failure Investment managementControl assessed ineffectiveIn remediation5 AugView Incorrect order entry Raised by hand Investment managementRaised by the second lineResponded6 AugView Trade debtors over 90 days AdvisoryValue 12% against a red threshold of 10%Responded1 JulView Two people are frozen onto each record, the author of the original submission and the author of the value that crossed red, and neither can write its response. A breach does not close itself when the next value comes in green. Closing one by hand needs a reason.

Screen 06 of 08

Closed means two people agreed

Actions arrive from breaches, risk events, control failures and quality findings, each linked to its cause, in one view. There is no one-click close.

Remediation

Every open remediation action in one view, and a closure waiting for its second person A drawn view of the platform. Four tiles count the actions that are open, on track, overdue and awaiting closure approval. Beneath them, four actions, each showing where it came from, its owner, its due date and its status. On the right, one closure request: raised by the owner, awaiting approval from a second-line person who is not the requester, with a note that the requester cannot approve their own closure. Connected risk intelligence All entities (Group) Dashboard Risk register Risk assessments Controls Control assessments KRI register KRI collection Breaches Risk events Remediation Committee packs Audit log MODULES TPRM & Supplier DD Obligations Management ICARA Operational Resilience Customer Oversight Portal RMRisk manager Remediation Every open action across the organisation · breaches, events, control failures and quality findings Log an action Open32 On track24 Overdue3 Awaiting a second person5 ACTIONSOURCEOWNERDUESTATUS Clear reconciliation backlog and fix the daily cut-off Breach IO 30 Sep Closing Re-perform quarterly access recertification Control failure SL 14 Oct On track Assign an owner to the two risks without one Quality finding RM 7 Oct On track Root cause review of the near miss on 12 Aug Risk event CO 2 Sep Overdue Each action links back to what caused it. Closing one takes two people. There is no one-click close and no one-click cancel. Closure request Clear reconciliation backlog and fix the daily cut-off IO Requested by the owner 2 Sep · work complete, evidence attached ? Awaiting a second person second line, and not the requester You requested this closure, so you cannot be the one to approve it. Approve refused for this user

Screen 07 of 08

The pack assembles from live data

Sections are chosen once and saved as a template. Every figure traces back to source, and the file is watermarked DRAFT until the approval chain is complete.

Committee reporting

A committee pack being configured and taken through its approval chain A drawn view of the platform. On the left, the eight sections of a pack with a switch beside each, one switched off. On the right, a preview page of the pack watermarked draft, and beneath it the approval chain: compiled and reviewed done, signed off in progress, released to come. Connected risk intelligence All entities (Group) Dashboard Risk register Risk assessments Controls Control assessments KRI register KRI collection Breaches Risk events Remediation Committee packs Audit log MODULES TPRM & Supplier DD Obligations Management ICARA Operational Resilience Customer Oversight Portal RMRisk manager Committee pack Group audit and risk committee · this quarter · assembled from live data Export PDF Sections Template: standard Executive summary Indicator early warning Risk appetite Principal riskstop 10 · outside appetite Risk events Path to green Indicator performance Control effectiveness Drag to reorder · filter to a band · cap · add commentary Preview data as at 30 Sep · page 1 of 14 Executive summary DRAFT Every figure traces back to source · exported 3 Oct 09:12 Commentary by the risk manager, dated APPROVAL CHAIN Compiledrisk manager Reviewedcompliance officer Signed offboard, awaiting Releasednot yet

Screen 08 of 08

Every change, written down

Who, what changed, from what to what, when, in what role and in which line of defence. Nothing edits or deletes an entry, and that holds for us as much as for your users.

Audit trail and quality checks

The audit log: entries counted by line of defence, a run of entries and the chain check A drawn view of the platform. Four tiles count the entries written by the first line, the second line and the system. Beneath them, six entries each with a time, a person, a line, a type and a plain description of what changed from what to what. On the right, a chain check reporting that every entry is linked to the one before and the chain is intact. Connected risk intelligence All entities (Group) Dashboard Risk register Risk assessments Controls Control assessments KRI register KRI collection Breaches Risk events Remediation Committee packs Audit log MODULES TPRM & Supplier DD Obligations Management ICARA Operational Resilience Customer Oversight Portal RMRisk manager Audit log This quarter · all entities · append-only Export CSV Entries1,284 First line702 Second line561 System21 WHENWHOLINETYPEWHAT CHANGED, FROM WHAT TO WHAT 09:35RM 2nd line Risk Residual score 12 → 9 on client money reconciliation, reason recorded 09:20IO 1st line KRI Submitted monthly value 3 for open complaints beyond target (v2) 09:04CO 2nd line Pack Approved review step on the group committee pack, as compliance officer 08:51RM 2nd line Action Requested closure of remediation action, awaiting a second person 08:12IO 1st line Control Operating effectiveness assessed: partially effective → effective 02:00SYS System Check Overnight rules run: two findings raised, each naming its rule and evidence Names and roles are held on each entry as they were at the time Chain check Intact every entry linked to the one before checked on demand Nothing edits an entry and nothing deletes one

See it against your own structure

Tell us how many sites, entities or business units you report on and the risks your organisation faces today, and we will walk you through the platform against that.

Request a walkthrough Follow one risk end to end

or write to sales@puretrace.co.uk

A person reads every enquiry and replies in writing.