Every risk, the control that treats it, and the policy that says so.
The Risk Register and Control Registry sit beside your document library and follow the same lifecycle. Link them to each other and to policy clauses, and the Impact Analyzer shows what else moves when one of them changes.
Risks
Controls
Policies
Registers that drift apart
The risk register, the control list and the policy index are maintained by different people in different files. They agree on the day of the audit and on no other day.
No way to see downstream impact
Retiring a control or rewriting a clause touches risks and documents nobody remembered. The impact is discovered later, by someone else.
Mapping without proof
A control that is listed but not linked to the policy that mandates it, or the risk it treats, is a line in a spreadsheet, not a control.
A catalogue of risks that behaves like a document
Each risk has an owner, a category, inherent and residual scores, and a lifecycle: Draft, Under review, Approved, Published, Archived. Changes are reviewed and approved the same way a policy is, so the register you show the board is the register that was signed off.
- Hierarchical tagging and org-wide tag pools
- Scores and ratings with configurable scales
- Full version history on every entry
Controls mapped to the risks they treat and the clauses that require them
Every control records its type, frequency, owner and testing cadence, and links to the risks it mitigates and the policy or procedure clauses that mandate it. From a control you can see every document that depends on it; from a clause you can see which control makes it real.
- Linked items keep risks, controls and documents connected
- Control references appear as chips in the policy text
- Registry administration with the same Draft to Published lifecycle
See what else is affected before you change anything
Select a policy, a risk or a control and the Impact Analyzer traces every linked item downstream: the clauses that cite it, the controls that depend on it, the assessments that scored it. Owners see the blast radius before they edit, not after the audit finding.
- Trace from any entity across the whole graph
- Flag documents due for re-review after a change
- Export the trace as evidence
Impact of retiring AML-C-002
One graph, not three lists
Risks, controls, regulations and documents are entities in one system, linked both ways. Change one and the others know.
Built for RCSA
Self-assessments run on these registers directly, so scores land on the real risk and the real control. See RCSA →
Audit-ready by construction
Every entry has a lifecycle, an owner and a history. The evidence is the register itself.
Bring the risk register out of the spreadsheet.
The trial comes with sample risks and controls already linked to sample policies.