Module: Governance
Risk
Every risk your organisation carries in one place, rated on your own matrix, with the controls that hold it down and the evidence that they are still working.
What it does
Registers for every level
Run a corporate register alongside operational ones, each with an owner, a description and its place in your structure. People work in the register that belongs to them and see the ratings in the language your organisation already uses.
Rated on your own matrix
Likelihood, consequence and rating bands come from the matrix your organisation uses, and you can hold more than one. Each risk records which version of the matrix it was rated on, so an old rating still makes sense years later.
Inherent, residual and target
Every risk carries the rating before controls, the rating with them, and the rating you are aiming for. A heat map across the register shows where residual risk sits, and selecting a cell filters the register to those risks.
Controls in the right order
Controls are listed by the hierarchy of controls, each with an owner, a type and a review date. When a high rated risk is held only by personal protective equipment, the record says so plainly.
Proof that controls still work
Set an assurance activity against a control: how often it is checked and who is responsible. Each control shows when it was last verified and when it is next due, and the register shows how much of the control set is verified and still current.
Bow-tie analysis
Build the bow-tie for a major risk by dragging threats, consequences, preventive and mitigating barriers and the factors that weaken them. Barrier effectiveness carries back to the controls list, so the diagram and the register agree.
Assessments done in the field
Safe work method statements, job safety analyses, take five checks and your own assessment types are completed on a phone or tablet and linked to the risk they assess. Each link carries a validity period, and the register flags risks whose assessment has expired or is due for review.
Corporate risks passed down
A risk held at the top can be sent to the parts of the business that carry it. A local team can accept it, propose a different rating or mark it not applicable with a reason, and that goes back for approval. The risk it came from stays visible.
How it fits with the rest
Risk is where the rest of the platform points. Treatment work raised against a risk becomes an action with an owner and a due date, sitting in the same work list as every other action and escalating the same way when it slips. An incident can be linked to the risk it realised, so the register shows which risks have actually bitten rather than only which ones were rated highest.
Controls are verified by the work you already do. An assurance activity schedules the check, and the inspection or field verification that follows updates the control on the risk. Assessments completed by crews in the field attach to the risk they assess and carry their own review date, so a risk standing on lapsed evidence is visible on the register instead of being taken on trust.
Risks share the same people, locations, projects and business units as every other module, and the risk assessment report can be generated as a document and kept with your other controlled records.
Ready-made content
The risk assessment pack installs a full assessment form and the workflow behind it: draft, review, approval, monitoring, a flag when the assessment falls due again, and archiving. It brings a risk assessment report template that produces a finished PDF, a quarterly risk register review on the schedule, and ready-made lists for assessment method, assessment scope and hazard source.
Assessment templates for the field cover the forms your teams already use, and the matrices, rating bands, categories and control types are all lists your organisation owns. Your own team can change any of it, or ask us to set it up with you.
Change it if you need to
Every module comes ready to use. If your organisation records something differently, your own team can adjust the forms, fields and workflow, or ask us to do it with you. Nothing here requires a development project.
Works alongside
See risk running on your own processes.
Bring one of your own forms or procedures to the demonstration. We set the module up the way you work and show it end to end.