ADD-ON · ENTERPRISE RISK MANAGEMENT

Catch it when it happens.

Risk rarely turns up during the hour you set aside for risk work. Observations give anyone a mobile-friendly way to report what they've noticed, through a link that doesn't ask them to log in. It lands in an inbox, and you decide what deserves to become a risk scenario.

Book a demo Watch the video

Trusted by 400+ organisations

Watch a demo of observations👇

GDPR-compliant

Hosted in EU

Free onboarding

+400 companies use .legal

The public report-a-risk form in .legal open on a phone, promising under two minutes, no assessment and delivery straight to the risk inbox of the people responsible

Most risks are noticed by someone who won't report them

Something gets mentioned in a meeting. A colleague walks past a room that shouldn't have been left unlocked. An advisory lands in someone's inbox. Then nothing happens, because there are three clicks and a login sitting between noticing something and recording it.

The reporter isn't a risk person: They don't have an account, and they shouldn't need one.
The moment passes: If it can't be reported in thirty seconds on a phone, it usually isn't reported at all.
Volume needs triage: Capturing more only helps if there's a sensible way to sort through what comes in.

The public observation link dialog in .legal, holding the URL anyone can use to report a risk observation, with the option to make it private again

Report from anywhere, no login required

Observations are shared through a public link.

No account needed: Anyone in the organisation can flag a concern without being a user in .legal.
Built for a phone: Short form, quick to submit, designed for the moment somebody notices something.
One link to share: Put it wherever people already are, on the intranet, in an onboarding pack, on a wall.

The observations inbox in .legal, listing a reported observation with its description, its source, its status and who observed it

Everything lands in one inbox

Reported observations arrive in a single place to be reviewed.

One queue: Whatever the source, it ends up somewhere with an owner rather than in a mailbox.
Reviewed, not auto-filed: A person decides what each observation actually is before anything happens to it.
A visible backlog: You can see what's waiting, which is the fastest way to keep it from piling up.

The convert-to-risk-scenario dialog in .legal for an observation about a USB stick left in a copy room, with risk areas, entity types and the option to notify the area responsibles

Convert an observation into a risk scenario

When something is worth acting on, it moves into the risk work properly.

One step across: Turn the observation into a risk scenario without retyping it somewhere else.
The responsible person is notified: Whoever owns the area finds out automatically.
Assessed like anything else: From there it follows the same route as every other scenario, with consequence, probability and justification.

The observations list in .legal filtered on archived, showing an observation closed rather than turned into a risk scenario

Not everything needs to become a risk

Closing something is a perfectly good outcome.

Triage is the job: Reviewing an observation and deciding it isn't relevant is a decision, and it's recorded as one.
Keeps the register honest: A risk register that absorbs everything reported to it quickly stops being useful.
Encourages reporting: People keep reporting when they can see it's being read, not when everything turns into a task.