Risk management software
A risk register that shows where each risk is, where its treatment will take it and where it should end up, with key risk indicators tied to named risks and appetite.
- Module typeOperational workspace (product module)
- LevelsEnterprise, divisional and operational, rolled up to enterprise parents
- MatrixLikelihood by consequence, configurable from 3x3 to 6x6 (5x5 by default)
- PositionsCurrent, projected (computed) and target, with residual
- IndicatorsKRIs with direction, cadence, owner and thresholds traceable to appetite
- ReportsPer-risk PDF, Word or PowerPoint; register in PDF, Word or Excel; executive deck
What risk management in GRCLens covers
Who it applies to
- Risk and compliance teams replacing spreadsheet risk registers
- Boards and audit committees that want current, projected and target positions on one page
- Banks, insurers and critical infrastructure operators reporting against appetite under APRA CPS 230, SAMA or SOCI
- Organisations whose business units keep their own risks, rolled up to enterprise risks
- Teams assessing privacy impact against the Australian Privacy Principles or New Zealand's Information Privacy Principles
Risk management software has one job a spreadsheet does badly: keeping every risk's rating, treatment and evidence current while the people who own them change. GRCLens runs one register across three levels (enterprise, divisional and operational), with divisional and operational risks rolling up to an enterprise parent, on a likelihood by consequence matrix you configure from 3x3 to 6x6. Fourteen categories, from cyber security and technology to financial, strategic, reputational, people and health and safety, keep it an enterprise risk register rather than an IT list.
Each risk carries three positions. Current is today's rating. Target is the rating you have decided to reach, or the residual rating when no target is set, and the screen says which. Projected is computed from the share of treatment tasks done, so a board sees where the plan will take the risk before it is finished. A risk with nothing to aim at shows no target, never zero, and a projection never moves a risk upward.
Key risk indicators follow the same honesty rules. Each KRI belongs to one named risk, has a unit, a cadence and an owner from the business function closest to the control, and has amber and red thresholds traceable to appetite. Direction is explicit, so a lower-is-worse indicator such as MFA coverage turns red as it falls, and an indicator nobody has read shows as not measured rather than green.
Related reading: Key risk indicators; GRC platform requirements for regulated entities
How GRCLens supports Risk Management
The risk register sits on the same platform as every framework assessment, so a penetration test finding, a threat or an incident can be raised straight into it with an owner, a treatment and a target.
Business context first
Every risk assessment opens on the business process and the information it handles, then runs through identification, privacy impact, analysis, treatment, controls, KRIs, tasks and comments. The per-risk report follows the same order.
Current, projected and target
Projected = current minus the gap to target times the share of treatment tasks done; with no tasks, a risk in monitoring counts as fully treated and any other as untreated. It is computed on read, never stored, so it cannot drift from the tasks it describes.
Consolidated matrices
The dashboard draws a current matrix and a target matrix in the same shape, with the movement between them, across every open risk at every level and business unit by default, and the register report draws both.
Key risk indicators that cannot hide
Higher-is-worse and lower-is-worse indicators, leading and lagging, each with an owner, a cadence and amber and red bands. An unread indicator is not measured, never green, so the emptiest register can never look like the healthiest. Starter indicators are suggested by risk category.
Delegation of authority
An authority matrix answers who may accept a risk of a given severity in a given unit: the lowest sufficient role, any second approver, and who is acting today. A severity above the unit's ceiling is shown as an escalation, not reassigned.
Treatment that is chased
Treatment tasks with owners and due dates drive the projected rating, and a daily job flags overdue treatments, appetite breaches and KRI thresholds crossed.
Risks raised from findings
Penetration test findings, threat-model threats and incidents can be raised into the register as operational risks, so a weakness found elsewhere on the platform gets an owner and a treatment.
Board reporting
Per-risk reports in PDF, Word or PowerPoint, the register in PDF, Word or Excel with both matrices drawn, an executive PowerPoint deck, and AI-drafted rating suggestions and board narratives for a person to review.
Risk Management frequently asked questions
What is risk management software?
Software that keeps an organisation's risk register current: each risk with an owner, a rating, a treatment plan, indicators and evidence, and reports that show the board where risk stands against appetite. In GRCLens it is the Risk Management workspace, on the same platform as the compliance frameworks.
Is GRCLens risk register software or ERM software?
Both. The register holds enterprise, divisional and operational risks in fourteen categories, from cyber security and technology to financial, strategic, reputational, people and health and safety, so enterprise risk management and the cyber risk register share one register and one appetite.
What is the difference between a KRI and a KPI?
A KPI measures performance; a KRI warns that a specific risk is moving towards or beyond appetite. In GRCLens a KRI is tied to one named risk, is numeric with a unit and a cadence, is owned by the business function closest to the control, and has amber and red thresholds traceable to appetite.
How is the projected risk rating calculated?
Projected = current minus (current minus target) times the share of treatment tasks marked done. With no tasks the share is 1 for a risk in monitoring and 0 otherwise. The target is the explicit target rating, or the residual rating when none is set, and a risk with neither shows no target.
Does GRCLens follow ISO 31000?
ISO 31000 is a set of guidelines, not a certifiable standard. The assessment in GRCLens follows its process: context first, then identification, analysis, treatment, and monitoring and review through KRIs, tasks and reports. GRCLens supports the process; it does not certify it.
Can business units keep their own risks?
Yes. Divisional and operational risks belong to a business unit and roll up to an enterprise parent. The consolidated matrices show every open risk across levels and units, and the enterprise view shows the enterprise risks on their own.
Who can accept a risk?
The authority matrix answers that: the lowest role whose ceiling covers the severity in that business unit, whether a second approver is needed, and who is acting if the holder is away. A severity above the unit's ceiling is reported as an escalation, with the group route named, rather than quietly reassigned.
Talk to us about Risk Management
Security Solution Consultants provides enterprise risk management services alongside the platform, so you can combine tooling with hands-on expertise.