Risk management
A risk register linked to the controls that treat each risk
Keep risks in the same workspace as the controls that treat them and the evidence behind those controls. When a risk is accepted, the acceptance is recorded with the name of the person who signed it.
In short
Each risk in Certifyi records its source, owner, scores and treatment, and the treatment can be linked to the controls that carry it out. Treatment decisions, including acceptance, are logged with the name of the person who made them and the date.
The risk register
Most organisations start with a spreadsheet. It works until there are fifty risks and three people editing it. Scores drift, versions multiply and nobody is sure which copy the board reviewed.
In Certifyi the register has set categories, consistent scoring and a record of every change. Each risk holds its source, owner, inherent score, treatment plan, residual score and review history.
- Source. Where the risk came from, such as an audit finding, an incident, a vendor assessment or a published vulnerability matched to one of your assets.
- Category. Operational, strategic, compliance, financial or technical, using categories you can change.
- Scoring. Likelihood and impact on scales you set, qualitative or semi-quantitative. Inherent and residual risk use the same method.
- Owner. A named person responsible for treatment and review. Changes of owner are logged.
- Reviews. Scheduled risk reviews, showing which risks have been reviewed and which are overdue.
| ID | Risk | Inherent | Treatment | Residual | Owner |
|---|---|---|---|---|---|
| RSK-041 | Ransomware attack on production | Critical | Mitigate | High | H. Tanaka |
| RSK-042 | Key-person dependency (CISO) | High | Mitigate | Medium | A. Petrov |
| RSK-043 | Vendor data breach (Tier 1) | High | Transfer | Medium | L. Mensah |
| RSK-044 | Regulatory change (EU AI Act) | Medium | Accept | Medium | S. Chen |
Risk register with inherent score, treatment and residual risk. Example data, not a customer record.
Treatment linked to controls and evidence
In a spreadsheet, the treatment column says "mitigate" and perhaps names a control. In Certifyi you link the treatment to the control itself, and the control holds the evidence that it operates.
A reviewer can start from a risk and follow the treatment to the control and the evidence behind it.
- Mitigate
- Reduce the likelihood or impact through controls. Each mitigation is linked to one or more controls in your control library.
- Accept
- The residual risk is within appetite. The acceptance is recorded with the person who signed it and the date.
- Transfer
- Move the financial impact to a third party through insurance or a contract. Record the policy or contract reference.
- Avoid
- Remove the risk by stopping the activity. Record the decision and the business reason.
Heatmaps for the board
Boards usually want to see the overall picture before the detail. The heatmap shows where risks sit by likelihood and impact, and a reviewer can open any risk to see its treatment, controls and evidence.
- Risk heatmap. Likelihood against impact, with the number of risks in each cell. Filter by category, owner or treatment status.
- From risk to evidence. Open a risk to see the controls that treat it and the evidence behind them.
What risk management in Certifyi covers
A risk register kept with your controls and evidence, so risk and compliance reviews use the same records.
-
Linked to controls
Treatments are linked to the controls in your library and the evidence behind them.
-
Vulnerabilities as risks
A published vulnerability matched to one of your assets can be tracked as a risk with an owner.
-
Logged decisions
Acceptance, treatment changes and changes of owner are logged with the person and the date.
-
Across frameworks
A risk can be linked to controls that serve several frameworks, so reviewers see where else it matters.
Related modules
Risks often start elsewhere: a vendor assessment, an incident or an audit finding. These are the modules they most often come from.
How Certifyi helps
Moving your risk register out of spreadsheets
What changes when you manage risk in Certifyi instead of a spreadsheet.
-
One register
Replace several spreadsheets with one register that has consistent scoring, owners and review dates.
-
Treatments linked to controls
Link each mitigation to the control that carries it out and the evidence behind it.
-
Heatmaps
Show management where risks sit, then open any risk to see its controls and evidence.
-
Decision history
Every risk decision carries the name of the person who made it and the date, kept in the tamper-evident activity log, so an acceptance signed last year can still be checked.
Questions
Risk management questions
Does Certifyi replace a dedicated risk management tool?
It covers the risk register, scoring, treatment planning and heatmaps. If you need specialised quantitative risk modelling, Certifyi may sit alongside that tool.
How are risks linked to controls?
Each treatment can be linked to one or more controls in your control library, so a reviewer can follow it to the control and its evidence.
Can I import existing risks?
Yes. Import risks from CSV or create them by hand. Each risk can record its source, such as an audit finding or an incident.
What risk scoring method does Certifyi use?
Likelihood multiplied by impact, on scales you set. You choose the size of the matrix (3×3, 4×4 or 5×5), the labels and the scoring criteria. Qualitative and semi-quantitative approaches are both supported.
Can I track risk acceptance decisions?
Yes. Acceptance is a formal treatment decision, recorded with the person who approved it, the date and the reason. It appears in the activity log.
See your risks next to the controls that treat them
Pick a risk your board asked about recently. Book a demo and we will follow one like it from its treatment to the controls behind it and the evidence an auditor will ask for.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them