We are introducing a new enterprise risk management add on that brings all your risk management into one place, whether you're working with GDPR, NIS2, the AI Act, information security or any other risk area. It covers everything from setting up risk areas and scenarios to assessing individual entities, planning mitigations and reporting to management. Instead of spreadsheets that each live their own life, you get one shared risk overview where assessments turn into action plans, and action plans turn into decisions, connecting the people doing the day-to-day assessments, the ones responsible for each risk area along with the management and board room.
Risk areas
Set up as many risk areas as you need. A risk area defines a specific compliance or security domain your organisation wants to assess and manage risk within, such as GDPR, NIS2, the AI Act, information security, or a custom area you define yourself. Each area comes with its own risk matrix, so you decide the scale (for example 1 to 3 or 1 to 6), the names and icons for each level, and the risk appetite that applies, tailoring the assessment to that domain's specific requirements. The risk appetite refers to the highest risk level the area accepts before anything scoring above it is flagged as over appetite.
The risk matrix maps each combination of consequence and probability to a risk level. The numbers in each cell represent the resulting risk level. The matrix is pre-filled with recommended defaults but can be edited by clicking any cell. You may want to adjust the matrix if your organisation has a more conservative or tolerant risk model, if regulatory requirements such as GDPR or NIS2 require certain combinations to always be treated as high risk, or if your industry weighs consequence and probability differently.
Risk scenarios, consequences and security measures
The same flexibility runs through risk scenarios, consequences and security measures: build your own from scratch or start from our catalogue. The catalogue is a predefined collection of common risk scenarios and consequences. Import the ones relevant to you to get started quickly and adjust from there if needed.
Global risk appetite
Define an overall risk appetite for you organisation. Specify how many risks, across all areas, may in total exceed appetite before it requires action from the management. This is a great way to spot if managerial action must be taken immediately.
Assess processes, assets and suppliers against concrete scenarios and get the risk level calculated automatically. To get started choose the entities that each risk area should risk assess. Once added you can add risk scenarios to the chosen entity. When assessing a risk scenario you must state the consequence level and consequences along with the probability level and security measures. Consequence and probability always need a justification, so you always have an audit trail to point to. You can also add risk exposure (estimated financial loss) if the risk materialises.
Assessments can be done one at a time or across many entities and risk scenarios at once through our bulk functionality.
Once a risk has been assessed, decide how to handle it: accept it as it stands, avoid it by stopping the activity that causes it, or mitigate it with an action plan. Mitigation plans include a description of the actions to be taken and the risk level you expect once they're completed.
Build action plans for the risks that need to come down, follow them through the whole journey from proposed to approved to completed, and see straight away what effect the plan is expected to have. Give the action plan an estimated cost and financial exposure after mitigation to help risk area responsibles and management to decide if a plan should be applied. Once a plan is completed, the current risk updates automatically, and the previous state is saved to history.
Mitigations can also be done one at a time or across many entities at once through our bulk functionality.
Every assessment adds to the record rather than replacing it, so nothing is ever overwritten. Each entity and scenario has its own timeline showing every assessment, decision and mitigation over time, which makes it straightforward to show why a risk was assessed the way it was, at the time it was assessed. The system also flags cases where a risk has been reassessed without a new action being taken, so nothing falls through.
Risk rarely sits in isolation, so we've added a relationship graph that shows how entities are connected, for example how a processing activity relates to the assets and suppliers behind it. This makes it easier to understand why an entity has inherited a risk from elsewhere in the chain, and to trace that connection as far as you need.
For anyone with overall responsibility for a risk area, we've added an overview that shows the bigger picture. A risk matrix shows how many entities fall into each combination of consequence and probability, alongside key figures such as how many entities are over appetite, linked risks over appetite and overdue mitigation plans. A chart shows how the risk distribution has developed over time, and you can switch between the current view, what it would look like if every mitigation plan were completed, and any past point in time, to see exactly how things looked then.
Where you manage several risk areas, a management report brings the numbers together across all of them, measured against your overall global risk appetite. It shows how many entities have been assessed, how many risks currently sit above appetite, and your financial exposure now and once your open mitigation plans are completed, together with what those plans are expected to cost. A breakdown by area shows where the pressure is coming from, and a trend over time shows whether the picture is improving or getting worse.
Alongside the module, we're introducing observations: a simple, mobile-friendly way to report something you've noticed, wherever you are. Observations are shared through a public link that doesn't require logging in, so anyone can flag a concern quickly. Reported observations land in an inbox, where they can be reviewed and, if relevant, converted into a risk scenario with the responsible person notified automatically.
We'd love to hear from you! Your input helps us keep improving the platform. Please don't hesitate to reach out to our support team with your thoughts, questions, or suggestions. 🚀