Risk Assessment

The risks of any part of your company, chosen by you, rated with the reason for each rating.

Includes: Risk heatmap (likelihood × impact)

Assesses the risks you choose in any area, from strategy, finance and suppliers to people, compliance and technology, where IT goes down to 54 domains; or those of a risk identification you select. Each risk is rated for likelihood and impact from a reference rating, adjusted to your situation and measures in place, with the reason written beside it; a risk you write yourself is rated from its facts. The level is calculated, never guessed. Risk owners decide what to accept.

Columns of the register

AreaRiskDescriptionLikelihood (1-5)Impact (1-5)ScoreLevelWhy this ratingRisk owner

1
Any area
Strategy, finance, operations, people, compliance, suppliers and technology, down to 54 IT domains.
2
Reasoned ratings
Each rating says why, from your situation, data and measures in place.
3
Heatmap
The matrix shows how many risks fall in each cell.

What you provide

Deliverable — Its title, its author and its structure are yours: they steer what is written.
What is assessed — Tick each area of the company concerned, from strategy to daily operations: each one opens its own list of risks to choose from.
Strategy and market — Choose the risks that concern you, add your own, and say what this area covers here.
Governance and decisions — Choose the risks that concern you, add your own, and say what this area covers here.
Reputation and communication — Choose the risks that concern you, add your own, and say what this area covers here.
Cash flow and liquidity — Choose the risks that concern you, add your own, and say what this area covers here.

Risk Assessment

The risks of any part of your company, chosen by you, rated with the reason for each rating.

Includes: Risk heatmap (likelihood × impact)

Run Risk Assessment

Columns of the register

AreaRiskDescriptionLikelihood (1-5)Impact (1-5)ScoreLevelWhy this ratingRisk owner

1
Any area
Strategy, finance, operations, people, compliance, suppliers and technology, down to 54 IT domains.
2
Reasoned ratings
Each rating says why, from your situation, data and measures in place.
3
Heatmap
The matrix shows how many risks fall in each cell.

What you provide

Deliverable — Its title, its author and its structure are yours: they steer what is written.
What is assessed — Tick each area of the company concerned, from strategy to daily operations: each one opens its own list of risks to choose from.
Strategy and market — Choose the risks that concern you, add your own, and say what this area covers here.
Governance and decisions — Choose the risks that concern you, add your own, and say what this area covers here.
Reputation and communication — Choose the risks that concern you, add your own, and say what this area covers here.
Cash flow and liquidity — Choose the risks that concern you, add your own, and say what this area covers here.

Fraud and payments — Choose the risks that concern you, add your own, and say what this area covers here.

Accounting and reporting — Choose the risks that concern you, add your own, and say what this area covers here.

Service delivery and production — Choose the risks that concern you, add your own, and say what this area covers here.

Quality and customer claims — Choose the risks that concern you, add your own, and say what this area covers here.

Business continuity — Choose the risks that concern you, add your own, and say what this area covers here.

Premises and equipment — Choose the risks that concern you, add your own, and say what this area covers here.

Project delivery — Choose the risks that concern you, add your own, and say what this area covers here.

Change and transformation — Choose the risks that concern you, add your own, and say what this area covers here.

Recruitment and key people — Choose the risks that concern you, add your own, and say what this area covers here.

Health and safety — Choose the risks that concern you, add your own, and say what this area covers here.

Conduct and ethics — Choose the risks that concern you, add your own, and say what this area covers here.

Employment law — Choose the risks that concern you, add your own, and say what this area covers here.

Contracts and liability — Choose the risks that concern you, add your own, and say what this area covers here.

Regulation and compliance — Choose the risks that concern you, add your own, and say what this area covers here.

Personal data protection — Choose the risks that concern you, add your own, and say what this area covers here.

Intellectual property — Choose the risks that concern you, add your own, and say what this area covers here.

Suppliers and procurement — Choose the risks that concern you, add your own, and say what this area covers here.

Customers and sales — Choose the risks that concern you, add your own, and say what this area covers here.

Stock and logistics — Choose the risks that concern you, add your own, and say what this area covers here.

Cyber security — Choose the risks that concern you, add your own, and say what this area covers here.

IT systems and tools — Choose the risks that concern you, add your own, and say what this area covers here.

Data and records — Choose the risks that concern you, add your own, and say what this area covers here.

Use of artificial intelligence — Choose the risks that concern you, add your own, and say what this area covers here.

Environment and sustainability — Choose the risks that concern you, add your own, and say what this area covers here.

Natural events and climate — Choose the risks that concern you, add your own, and say what this area covers here.

Economy and geopolitics — Choose the risks that concern you, add your own, and say what this area covers here.

Going deeper into technology — Opened by a technology area: each IT domain ticked opens its own list of risks.

Data centres and server rooms — Choose the risks that concern you, add your own, and say what this domain covers here.

Servers and operating systems — Choose the risks that concern you, add your own, and say what this domain covers here.

Virtualisation platforms — Choose the risks that concern you, add your own, and say what this domain covers here.

Storage systems — Choose the risks that concern you, add your own, and say what this domain covers here.

Backup and recovery — Choose the risks that concern you, add your own, and say what this domain covers here.

Local and campus networks — Choose the risks that concern you, add your own, and say what this domain covers here.

Wide-area links and SD-WAN — Choose the risks that concern you, add your own, and say what this domain covers here.

Wireless networks — Choose the risks that concern you, add your own, and say what this domain covers here.

Firewalls and network perimeter — Choose the risks that concern you, add your own, and say what this domain covers here.

DNS and DHCP — Choose the risks that concern you, add your own, and say what this domain covers here.

VPN and remote access — Choose the risks that concern you, add your own, and say what this domain covers here.

Voice and telecoms — Choose the risks that concern you, add your own, and say what this domain covers here.

Public cloud (IaaS and PaaS) — Choose the risks that concern you, add your own, and say what this domain covers here.

SaaS applications — Choose the risks that concern you, add your own, and say what this domain covers here.

Containers and Kubernetes — Choose the risks that concern you, add your own, and say what this domain covers here.

Identity and access management — Choose the risks that concern you, add your own, and say what this domain covers here.

Directory services (Active Directory, Entra ID) — Choose the risks that concern you, add your own, and say what this domain covers here.

Privileged access — Choose the risks that concern you, add your own, and say what this domain covers here.

Secrets, certificates and service accounts — Choose the risks that concern you, add your own, and say what this domain covers here.

Laptops and workstations — Choose the risks that concern you, add your own, and say what this domain covers here.

Mobile devices and BYOD — Choose the risks that concern you, add your own, and say what this domain covers here.

Email and collaboration — Choose the risks that concern you, add your own, and say what this domain covers here.

Printers and peripherals — Choose the risks that concern you, add your own, and say what this domain covers here.

Business applications (ERP, CRM) — Choose the risks that concern you, add your own, and say what this domain covers here.

Web applications and APIs — Choose the risks that concern you, add your own, and say what this domain covers here.

Software development — Choose the risks that concern you, add your own, and say what this domain covers here.

Build and deployment pipelines — Choose the risks that concern you, add your own, and say what this domain covers here.

Third-party and open-source components — Choose the risks that concern you, add your own, and say what this domain covers here.

Legacy and end-of-life systems — Choose the risks that concern you, add your own, and say what this domain covers here.

Databases — Choose the risks that concern you, add your own, and say what this domain covers here.

Data classification and leakage — Choose the risks that concern you, add your own, and say what this domain covers here.

Encryption and key management — Choose the risks that concern you, add your own, and say what this domain covers here.

Personal data processing — Choose the risks that concern you, add your own, and say what this domain covers here.

Data platforms and analytics — Choose the risks that concern you, add your own, and say what this domain covers here.

AI systems and models — Choose the risks that concern you, add your own, and say what this domain covers here.

Logging and security monitoring — Choose the risks that concern you, add your own, and say what this domain covers here.

Vulnerability and patch management — Choose the risks that concern you, add your own, and say what this domain covers here.

Malware and ransomware — Choose the risks that concern you, add your own, and say what this domain covers here.

Incident response — Choose the risks that concern you, add your own, and say what this domain covers here.

Security awareness — Choose the risks that concern you, add your own, and say what this domain covers here.

IT service and change management — Choose the risks that concern you, add your own, and say what this domain covers here.

Monitoring and capacity — Choose the risks that concern you, add your own, and say what this domain covers here.

Disaster recovery and IT continuity — Choose the risks that concern you, add your own, and say what this domain covers here.

IT asset management and licences — Choose the risks that concern you, add your own, and say what this domain covers here.

Automation and scripting — Choose the risks that concern you, add your own, and say what this domain covers here.

IT staff and key-person dependency — Choose the risks that concern you, add your own, and say what this domain covers here.

IT suppliers and supply chain — Choose the risks that concern you, add your own, and say what this domain covers here.

Managed service providers — Choose the risks that concern you, add your own, and say what this domain covers here.

Industrial control systems (OT/ICS) — Choose the risks that concern you, add your own, and say what this domain covers here.

IoT and connected devices — Choose the risks that concern you, add your own, and say what this domain covers here.

Payment systems (card data) — Choose the risks that concern you, add your own, and say what this domain covers here.

Medical devices and health systems — Choose the risks that concern you, add your own, and say what this domain covers here.

Branch offices and remote sites — Choose the risks that concern you, add your own, and say what this domain covers here.

Website and domain names — Choose the risks that concern you, add your own, and say what this domain covers here.

Your situation — These answers adjust each rating, and the reason is written beside it.

Known risks and owners — What you already know, added to the assessment.