Builds your risk register from the parts of your business you choose (strategy, finance, operations, projects, people, legal, suppliers, technology and more), the risks you already know or an earlier assessment. Each risk gets a rating with its reason, a proposed action, an owner and a next review date. It stays editable, so the register follows the treatment and the reviews over time.
Columns of the register
AreaRiskDescriptionLikelihood (1-5)Impact (1-5)ScoreLevelWhy this ratingProposed actionRisk ownerTreatmentStatusNext review
1
Any part of your business
30 areas, from cash flow and projects to people, suppliers and technology, and any other you name.
2
Ready to act on
Each risk says why it has its rating and what to do next, with an owner and a review date.
3
Heatmap
The matrix shows how many risks fall in each cell.
What you provide
Deliverable — Its title, its author and its structure are yours: they steer what is written.
What is registered — Tick each area of the company concerned, from strategy to daily operations: each one opens its own list of risks to choose from.
Strategy and market — Choose the risks that concern you, add your own, and say what this area covers here.
Governance and decisions — Choose the risks that concern you, add your own, and say what this area covers here.
Reputation and communication — Choose the risks that concern you, add your own, and say what this area covers here.
Cash flow and liquidity — Choose the risks that concern you, add your own, and say what this area covers here.
Fraud and payments — Choose the risks that concern you, add your own, and say what this area covers here.
Accounting and reporting — Choose the risks that concern you, add your own, and say what this area covers here.
Service delivery and production — Choose the risks that concern you, add your own, and say what this area covers here.
Quality and customer claims — Choose the risks that concern you, add your own, and say what this area covers here.
Business continuity — Choose the risks that concern you, add your own, and say what this area covers here.
Premises and equipment — Choose the risks that concern you, add your own, and say what this area covers here.
Project delivery — Choose the risks that concern you, add your own, and say what this area covers here.
Change and transformation — Choose the risks that concern you, add your own, and say what this area covers here.
Recruitment and key people — Choose the risks that concern you, add your own, and say what this area covers here.
Health and safety — Choose the risks that concern you, add your own, and say what this area covers here.
Conduct and ethics — Choose the risks that concern you, add your own, and say what this area covers here.
Employment law — Choose the risks that concern you, add your own, and say what this area covers here.
Contracts and liability — Choose the risks that concern you, add your own, and say what this area covers here.
Regulation and compliance — Choose the risks that concern you, add your own, and say what this area covers here.
Personal data protection — Choose the risks that concern you, add your own, and say what this area covers here.
Intellectual property — Choose the risks that concern you, add your own, and say what this area covers here.
Suppliers and procurement — Choose the risks that concern you, add your own, and say what this area covers here.
Customers and sales — Choose the risks that concern you, add your own, and say what this area covers here.
Stock and logistics — Choose the risks that concern you, add your own, and say what this area covers here.
Cyber security — Choose the risks that concern you, add your own, and say what this area covers here.
IT systems and tools — Choose the risks that concern you, add your own, and say what this area covers here.
Data and records — Choose the risks that concern you, add your own, and say what this area covers here.
Use of artificial intelligence — Choose the risks that concern you, add your own, and say what this area covers here.
Environment and sustainability — Choose the risks that concern you, add your own, and say what this area covers here.
Natural events and climate — Choose the risks that concern you, add your own, and say what this area covers here.
Economy and geopolitics — Choose the risks that concern you, add your own, and say what this area covers here.
Going deeper into technology — Opened by a technology area: each IT domain ticked opens its own list of risks.
Data centres and server rooms — Choose the risks that concern you, add your own, and say what this domain covers here.
Servers and operating systems — Choose the risks that concern you, add your own, and say what this domain covers here.
Virtualisation platforms — Choose the risks that concern you, add your own, and say what this domain covers here.
Storage systems — Choose the risks that concern you, add your own, and say what this domain covers here.
Backup and recovery — Choose the risks that concern you, add your own, and say what this domain covers here.
Local and campus networks — Choose the risks that concern you, add your own, and say what this domain covers here.
Wide-area links and SD-WAN — Choose the risks that concern you, add your own, and say what this domain covers here.
Wireless networks — Choose the risks that concern you, add your own, and say what this domain covers here.
Firewalls and network perimeter — Choose the risks that concern you, add your own, and say what this domain covers here.
DNS and DHCP — Choose the risks that concern you, add your own, and say what this domain covers here.
VPN and remote access — Choose the risks that concern you, add your own, and say what this domain covers here.
Voice and telecoms — Choose the risks that concern you, add your own, and say what this domain covers here.
Public cloud (IaaS and PaaS) — Choose the risks that concern you, add your own, and say what this domain covers here.
SaaS applications — Choose the risks that concern you, add your own, and say what this domain covers here.
Containers and Kubernetes — Choose the risks that concern you, add your own, and say what this domain covers here.
Identity and access management — Choose the risks that concern you, add your own, and say what this domain covers here.
Directory services (Active Directory, Entra ID) — Choose the risks that concern you, add your own, and say what this domain covers here.
Privileged access — Choose the risks that concern you, add your own, and say what this domain covers here.
Secrets, certificates and service accounts — Choose the risks that concern you, add your own, and say what this domain covers here.
Laptops and workstations — Choose the risks that concern you, add your own, and say what this domain covers here.
Mobile devices and BYOD — Choose the risks that concern you, add your own, and say what this domain covers here.
Email and collaboration — Choose the risks that concern you, add your own, and say what this domain covers here.
Printers and peripherals — Choose the risks that concern you, add your own, and say what this domain covers here.
Business applications (ERP, CRM) — Choose the risks that concern you, add your own, and say what this domain covers here.
Web applications and APIs — Choose the risks that concern you, add your own, and say what this domain covers here.
Software development — Choose the risks that concern you, add your own, and say what this domain covers here.
Build and deployment pipelines — Choose the risks that concern you, add your own, and say what this domain covers here.
Third-party and open-source components — Choose the risks that concern you, add your own, and say what this domain covers here.
Legacy and end-of-life systems — Choose the risks that concern you, add your own, and say what this domain covers here.
Databases — Choose the risks that concern you, add your own, and say what this domain covers here.
Data classification and leakage — Choose the risks that concern you, add your own, and say what this domain covers here.
Encryption and key management — Choose the risks that concern you, add your own, and say what this domain covers here.
Personal data processing — Choose the risks that concern you, add your own, and say what this domain covers here.
Data platforms and analytics — Choose the risks that concern you, add your own, and say what this domain covers here.
AI systems and models — Choose the risks that concern you, add your own, and say what this domain covers here.
Logging and security monitoring — Choose the risks that concern you, add your own, and say what this domain covers here.
Vulnerability and patch management — Choose the risks that concern you, add your own, and say what this domain covers here.
Malware and ransomware — Choose the risks that concern you, add your own, and say what this domain covers here.
Incident response — Choose the risks that concern you, add your own, and say what this domain covers here.
Security awareness — Choose the risks that concern you, add your own, and say what this domain covers here.
IT service and change management — Choose the risks that concern you, add your own, and say what this domain covers here.
Monitoring and capacity — Choose the risks that concern you, add your own, and say what this domain covers here.
Disaster recovery and IT continuity — Choose the risks that concern you, add your own, and say what this domain covers here.
IT asset management and licences — Choose the risks that concern you, add your own, and say what this domain covers here.
Automation and scripting — Choose the risks that concern you, add your own, and say what this domain covers here.
IT staff and key-person dependency — Choose the risks that concern you, add your own, and say what this domain covers here.
IT suppliers and supply chain — Choose the risks that concern you, add your own, and say what this domain covers here.
Managed service providers — Choose the risks that concern you, add your own, and say what this domain covers here.
Industrial control systems (OT/ICS) — Choose the risks that concern you, add your own, and say what this domain covers here.
IoT and connected devices — Choose the risks that concern you, add your own, and say what this domain covers here.
Payment systems (card data) — Choose the risks that concern you, add your own, and say what this domain covers here.
Medical devices and health systems — Choose the risks that concern you, add your own, and say what this domain covers here.
Branch offices and remote sites — Choose the risks that concern you, add your own, and say what this domain covers here.
Website and domain names — Choose the risks that concern you, add your own, and say what this domain covers here.
Your situation — These answers adjust each rating, and the reason is written beside it.
Known risks and owners — What you already know, added to the register.
