Platform ยท Risk register and self-assessments
Every risk, with an owner and a score, before and after controls.
A risk register that lists every risk with its owner, scores it before and after controls, and ties self-assessments, loss events and scenarios to the same record, next to your dollar exposure and regulatory weather.
The problem it removes
A register that lives in a spreadsheet
- Risks, owners and scores sit in a spreadsheet nobody trusts after the second edit.
- Self-assessments arrive by email and never reach the register.
- Losses and near misses aren't tied back to the risks they belong to.
What you see
Risks, scores and the heat map
Each risk shows its owner, its inherent and residual score, the controls that reduce it, and where it sits against appetite.
| Risk | Owner | Inherent | Residual | Appetite |
|---|---|---|---|---|
| Sanctions screening gaps | BSA Officer | High | Moderate | Inside |
| Partner program onboarding | Head of Partnerships | Moderate | Low | Inside |
Illustrative example with invented entries.
How it works
From record to review
- Risks are recorded with an owner, a category and inherent and residual scores.
- Business areas complete self-assessments on the risks and controls they own.
- Loss events and scenarios attach to the risks they belong to.
- A practitioner reviews the register before it reaches the board.
Guardrails
What it will never do
- It doesn't score a risk without its owner's review.
- A scenario result ranks risks. It isn't a forecast of what a regulator will do.
Where it shows up
The work this part does for you
Plain English
What this is, and how anyone does it
Reference articles from our library, cited to the published rules and standards. No sales copy.
- ReferenceGRC (Governance, Risk and Compliance): Definition and FrameworksOCEG's definition and principled performance, the IIA Three Lines Model, the COSO frameworks, what GRC software holds, and the limits of a GRC program.
- Field GuideHow to Build a BSA/AML Risk Assessment MatrixA step-by-step build: set the rating scale, rate inherent risk, score controls, derive residual risk, and aggregate to an enterprise rating. With a worked example.
Connected parts
What it works with
Talk to a practitioner
Book a 15-minute chat with our founder.
A real conversation with a senior compliance leader, to see if there's a fit. Not a sales call, not a demo, no pressure.