ADD-ON · ENTERPRISE RISK MANAGEMENT

From a coloured cell to a task somebody owns.

Identifying a risk is the easy part. Deciding what to do about it is where risk work either becomes real or quietly stops. Accept it, avoid it, or build a plan, and follow that plan from proposed through approved to completed.

Trusted by 400+ organisations
Watch a demo of risk treatment👇
GDPR-compliant
Hosted in EU
Free onboarding
+400 companies use .legal
Region Sjælland
Aarhus Universitet
aj_vaccines_logo
Realdania
Right People
IO Gates
PLO
Finans Danmark
geia-food
Evida
Klasselotteriet
NRGI1
BLUE WATER SHIPPING
Karnov
Ingvard Christensen
VP Securities
AH Industries
Lægeforeningen
InMobile
AK Nygart
DEIF
DMJX
Axel logo
qUINT Logo
KAUFMANN (1)
SMILfonden-logo
kurhotel_skodsborg
nemlig.com
Molecule Consultancy
Novicell
The operational view of a risk area in .legal filtered to risks over appetite, with financial exposure of 725,000 EUR falling to 435,000 EUR after mitigation

A risk register nobody acts on is just a list

The moment a risk is written down, you've taken a position on it. Including if you do nothing. Most registers fall apart at exactly this point, because the decision lives in an email thread and the action lives in someone's head.

  • Start where it matters: The interesting risks are the ones above the appetite you set yourselves, not the whole register.
  • Three real options: Accepting a risk is a legitimate decision, as long as it's a decision rather than an oversight.
  • Plans need owners: An action plan without a status and a responsible person is a good intention.
Intro

Accept, avoid or mitigate

A short look at how an assessment turns into an action plan.

Key figures at the top of a risk area in .legal: 27 of 27 entities assessed and four risks over appetite, two of them without a treatment decision

Start from what's above appetite

Every area shows how many risks currently sit above the line you've set.

  • Filter straight to it: Go from the full register to the ones that need a decision in one click.
  • Context stays attached: The assessment, the justification and the history sit right next to the risk you're deciding on.
  • Nothing hides: Risks above appetite show up in the area overview and in the management report without anyone flagging them manually.
The row menu on a risk scenario in .legal, open on the treatment options: mitigate, accept or avoid

Accept, avoid or mitigate

Once a risk is assessed, you choose how to handle it.

  • Accept: Live with the risk as it stands, with the reasoning recorded.
  • Avoid: Stop the activity that creates the risk in the first place.
  • Mitigate: Build an action plan describing what will be done and the risk level you expect to land on afterwards.
The mitigation tab of a risk area in .legal, with plans counted by status from proposal through approved, planned and in progress to completed, above a list showing each plan's risk level before and after

Follow the plan from proposed to completed

Mitigation plans move through a lifecycle, so it's always clear where one has got to.

  • Proposed, approved, completed: Approval happens in the platform rather than in a mail thread nobody can find later.
  • Expected effect up front: The plan states the risk level you expect once it's done, so the decision to approve it is an informed one.
  • Overdue plans surface: Anything past its date shows in the area overview as a figure, not as a surprise.
A risk area in .legal in its after-mitigation view, with arrows in the matrix showing where entities move once the open plans are completed

Completed plans update the risk automatically

When a plan is marked as completed, the current risk level updates on its own.

  • No double bookkeeping: You don't reassess separately just to reflect work you've already recorded.
  • History is kept: The previous state is saved, so you can still see what the risk looked like before the plan.
  • The picture moves: The area overview and the management report both reflect the change straight away.
The bulk mitigation dialog in .legal, with four entities selected for the same mitigation plan and a note that entities without an assessment of the chosen scenario are skipped

Mitigate across many entities at once

One control often addresses the same risk on ten different systems.

  • Bulk mitigation: Apply the same plan across several entities in one action.
  • Consistent wording: The same measure described the same way everywhere, which matters when an auditor reads it.
  • A real work list: The plan overview shows what's waiting for approval and what's overdue, in one place.
The .legal customer success team, ready to help with onboarding and support

Getting You Started Customer Support

You can always get help from a team member who’s ready to support you and your colleagues.
  • You get a dedicated Customer Success Manager.
  • Personal onboarding to ensure a smooth start.
  • Support available Monday to Friday, 9 AM to 3 PM.
A risk area in .legal showing the risk picture as it would be once every open mitigation plan is completed

.legal compliance platform Begin with Enterprise Risk Management today

Curious to see it on your own risk work? Book a conversation and we'll walk through your risk areas, your scales and where the add-on would fit.
  • Works alongside your existing frameworks
  • Free onboarding included
  • No commitment

Frequently Asked Questions about Risk Treatment

Do I have to mitigate every risk above appetite?

No. Accepting a risk is a valid decision. The point is that it's recorded as a decision, with reasoning, rather than left open.

How risk appetite is set per area

Who approves a mitigation plan?

Plans move from proposed to approved to completed, so approval sits with whoever holds that responsibility in your organisation and is recorded in the platform.

Can I see what effect a plan is expected to have before approving it?

Yes. The plan states the risk level you expect once it's completed, and you can also add the estimated cost and the exposure after mitigation.

Risk exposure and mitigation cost

What happens when a plan is completed?

The current risk level updates automatically and the previous state is saved to history.

Can one plan cover several entities?

Yes. Bulk mitigation applies the same plan across multiple entities at once.

How entities connect to each other

Will I be told when a plan is overdue?

Overdue mitigation plans appear as a key figure in the area overview, so they're visible rather than buried.

Still unsure?

Ask Johannes directly, he runs most demos personally

Book him here
+400 companies use .legal
Region Sjælland
Aarhus Universitet
aj_vaccines_logo
Realdania
Right People
IO Gates
PLO
Finans Danmark
geia-food
Evida
Klasselotteriet
NRGI1
BLUE WATER SHIPPING
Karnov
Ingvard Christensen
VP Securities
AH Industries
Lægeforeningen
InMobile
AK Nygart
DEIF
DMJX
Axel logo
qUINT Logo
KAUFMANN (1)
SMILfonden-logo
kurhotel_skodsborg
nemlig.com
Molecule Consultancy
Novicell