Legal, Risk & Compliance · Module
Enterprise Risk
A live risk register tied to objectives, appetite and KRIs from your own data
Enterprise Risk keeps a live register linked to objectives and a board-approved appetite. KRIs are computed from platform metrics and treatments are tracked as work.
What it does
Enterprise Risk is designed to maintain a live enterprise risk register tied to strategy and operations. Risks link to objectives in Goals, are assessed against a board-approved appetite, are monitored through KRIs computed from platform metrics, and are treated through tracked actions.
Register and methodology
A configurable taxonomy covers strategic, operational, financial, compliance, technology, third-party and ESG risks with hierarchy. Each risk records cause, event, consequence, owner, linked objectives, entity and business unit. Assessment uses likelihood × impact scales from 3×3 to 5×5, inherent and residual ratings, and qualitative or quantitative impact. Appetite statements per category carry thresholds and are versioned.
Monitoring and treatment
KRIs have a definition, source metric (semantic layer or manual), green, amber and red thresholds and frequency. At GA, KRIs bind directly to platform metrics, for example attrition from People, overdue receivables from Finance or SLA breaches from Service Desk. Treatments (mitigate, transfer, avoid, accept) have a plan, owner, due date and cost, with tasks in Projects where subscribed. Accepting a risk above appetite needs formal approval per DoA and an expiry. Periodic self-assessment campaigns go to risk owners on light seats.
Reporting and linkage
Heatmaps, top risks, movement since last period and appetite breaches feed a Board Portal pack. Residual ratings are informed by GRC control effectiveness. Emerging-risk detection clusters incidents, aggregated ethics themes, KRI trends and regulatory changes into candidate risks with evidence that a person accepts. Loss events and near misses are recorded with amount and root cause. Operational resilience and IT and cyber risk linkage are planned, with bow-tie analysis, Monte Carlo quantification and business continuity plans in W5.
Planned for W4 (Year 3).
Features
What Enterprise Risk includes
Risk taxonomy
Configurable categories and hierarchy from strategic to ESG.
Risk register
Cause, event, consequence, owner, linked objectives, entity and business unit.
Assessment methodology
Configurable likelihood × impact scales, inherent and residual ratings, qualitative and quantitative impact.
Risk appetite and tolerances
Board-approved, versioned appetite statements per category with thresholds.
KRIs from platform data
Indicators bound to metrics such as attrition, overdue receivables or SLA breaches, with RAG thresholds.
Treatments
Mitigate, transfer, avoid or accept with plan, owner, due date, cost and Projects tasks.
Risk acceptance
Formal acceptance above appetite with DoA approver and expiry.
Assessment campaigns
Quarterly or annual self-assessments by risk owners with reminders.
Heatmaps and board reports
Top risks, movement and appetite breaches packaged for the Board Portal.
Emerging-risk detection
Candidate risks clustered from signals with evidence, accepted by a person.
Loss events and control linkage
Loss and near-miss register; residual rating informed by GRC control effectiveness.
Workflow
KRI breach
- 1
A KRI computed from a platform metric crosses its threshold
- 2
The risk owner is alerted with drivers from metric lineage
- 3
A treatment plan is created or updated
- 4
Acceptance above appetite needs DoA approval
- 5
The board pack reflects the movement
AI
AI skills and Digital Employees
Emerging-risk candidates
Clusters signals into candidate risks with evidence ids for human acceptance.
KRI breach explanation
Explains drivers using metric lineage.
Risk statement quality check
Inline hints on cause, event and consequence completeness.
Board pack narrative
Draft narrative where every figure is rendered from records.
Digital Employees that use this module
They act through the same governed Actions as people; risky steps wait for approval.
Frequently asked questions
Where do KRIs come from?
From platform metrics through the semantic layer, or manual entry where no metric exists.
Does AI rate risks?
No. AI proposes candidate risks and explains KRI movements; risk owners assess and accept.
Is quantitative risk modelling included?
Monte Carlo quantification and scenario analysis are planned for W5.
See Enterprise Risk in your workflow
Tell us about your team and the outcomes you want. We will walk you through the apps, the Digital Employees and the plan for your industry.