ADD-ON · ENTERPRISE RISK MANAGEMENT

See risk in context.

A process can look perfectly harmless on its own. But it runs on a system, the system is hosted by a supplier, and somewhere down that chain sits a risk you never assessed on the process itself. The relationship graph shows you how it all connects.

Book a demo Watch the video

Trusted by 400+ organisations

Watch a demo of linked risks👇

GDPR-compliant

Hosted in EU

Free onboarding

+400 companies use .legal

The entity relationship graph in .legal, with a CRM processing activity connected to five assets and one of those onwards to a supplier rated high and flagged as one risk over appetite

A spreadsheet has rows. Reality has connections.

Risk rarely sits in isolation. A processing activity depends on the assets behind it, and those assets depend on suppliers, who depend on someone else again. That chain is where inherited risk lives, and it's almost impossible to see in a list.

Low risk isn't always low risk: An entity can look fine while being surrounded by things that aren't.
Inheritance needs explaining: When something is flagged, you need to be able to trace why, not just that it was.
Insight has to lead somewhere: A graph is interesting. A graph that takes you to an action plan is useful.

The relationship graph in .legal expanded across several levels, from processing activities down through assets to a supplier and on to its own sub-supplier

See how your entities connect

The relationship graph shows an entity and everything attached to it.

Processes, assets and suppliers: See how a processing activity relates to the systems and suppliers behind it.
Follow the chain: Trace the connection outwards as far as you need to go.
Readable, not a spiderweb: Built to be understood in a meeting, not decoded afterwards.

The relationship graph in .legal with a supplier selected, and a panel listing what it supports, what it depends on, and the ten entities affected if it fails, each with its distance in hops

Understand where a risk was inherited from

When an entity picks up risk from elsewhere, the graph shows you the route.

Trace it back: See which connected entity is the actual source.
Explain it to others: Much easier to justify a rating when you can point at the chain rather than describe it.
Catch what a list would miss: Exposure that lives two steps away from the thing you're responsible for.

Key figures at the top of a risk area in .legal: entities assessed, and risks over appetite with the number still lacking a treatment decision

Linked risks above appetite, as a figure

The insight becomes a number you can act on.

In the area overview: Linked risks over appetite sits alongside entities over appetite and overdue plans.
A prioritisation signal: It tells you where to look first, rather than leaving it to whoever happens to open the graph.
Visible to the area owner: Anyone with overall responsibility for an area sees it as part of the standard picture.

The mitigation tab of a risk area in .legal, showing each plan's entity, its scenario and the risk level expected once the plan is completed

From the graph to the action plan

Insight is the first half. The second half is doing something.

Click through: Move from the graph to the specific entity and its assessment.
Treat it like any other risk: Accept, avoid or build a mitigation plan, from the same place.
Closes the loop: What you saw in the graph ends up as a task with an owner and a date.