Risk as a continuous discipline,
not an annual spreadsheet.
Your risk register starts populated from your risk profile and frameworks. Each risk is assessed, treated and owned, and residual risk comes down as the linked tasks are completed.
Risk Manager · residual risk falls as the work is done
Illustration of the likelihood by impact grid. Not client data.
- 5 × 5
- Inherent and residual heatmaps
- 4 treatments
- Mitigate, transfer, avoid or accept
- Task-driven
- Residual risk falls as linked work is done
- Register export for board and committee packs
How a risk comes down
Treatment is real work, so the register moves for a reason you can show.
- 1
Risks generated
From your risk profile and enabled frameworks.
- 2
Inherent risk assessed
Likelihood and impact before treatment.
- 3
Treatment and owner
Mitigate, transfer, avoid or accept, with a named owner.
- 4
Linked tasks done
The treatment is carried out in the Task Engine.
- 5
Residual risk falls
Visible on the residual heatmap and in the register.
Risk register
A register that moves, with evidence of why
Every risk shows its score, its inherent and residual rating, the treatment chosen, the tasks behind it and how many are complete.
- Risk score out of 10, inherent and residual risk side by side
- Treatment plan and status for every risk
- Linked tasks and task completion, so progress is visible
- An owner and a last-reviewed date on each risk
What a row on the register holds
Treatment
Choices a board can follow
Each risk is treated in one of four ways, and each choice is recorded with its owner so the board can see what was decided and why.
- Treatment options carry their budget implications for the board
- A Key Risks filter gives directors a focused view
- Risk tolerance thresholds shown against the current picture
The four treatments
The register
A register that moves because the work moved
Forty-two risk categories, each with a score out of ten that is nothing but the work completed under it, the inherent and residual bands, the treatment chosen and the person who answers for it.
- 1The score is the workFour point one out of ten because twelve of twenty-nine tasks are done. There is no field anywhere for typing a risk score in, which is why it survives a question in a committee.
- 2Inherent and residual, as bandsExtreme, high, medium or low, before the controls and after them. Two people reading the register reach the same conclusion because nobody is converting a number in their head.
- 3Unassigned is a findingA risk with no owner has nobody doing the work, which is why its score is nought. The register shows that in the same row rather than hiding it in a report.
- 4Where the score comes fromTwenty-three of forty-seven. Open the count and the Task Engine lists them, each with an owner and a due date.
Nothing in this table is typed in by hand. The score is task completion, the task counts come from the Task Engine, and the review date is the last time a person actually looked. A risk with no owner and no treatment plan shows itself in the same row rather than in a separate report.
Inside one risk
A risk a committee can read and an auditor can follow
- 1Completion, and the score it producesTwenty-three of fifty-two tasks done is forty-four per cent, and forty-four per cent is four point four out of ten. The ring is not a second opinion; it is the same number.
- 2What the owner expects to go wrongThe function and the security principles place the risk, and the realisation note says in plain words what would actually cause it here.
- 3Bands, and the board’s thresholdInherent high, residual low, against a tolerance of medium. The comparison the board asked for is answered on the record rather than in the room.
- 4Key risk, treatment and ownerThe key risk flag puts it on the directors’ short list, and the treatment, status and named owner sit beside it.
Everything a risk committee asks about a single risk, on one record: what it is, which function it belongs to, what the owner expects to go wrong, how far the treatment has got and where it sits against the tolerance the board set. The work that treats it is one click away.
The profile
Where the work has been done, and where it has not
- 1A long arm is work that is doneEach arm is one category, and its length is the share of that category’s tasks that are complete and evidenced. Long is good.
- 2A dent is where to lookThe short arms are the categories nobody has worked through yet. Two of them have no owner at all, which is why they sit at nought.
- 3The six shortest, in wordsA chart is a picture of something. The six lowest are named underneath with the tasks done against the tasks held, so the conversation starts on the arithmetic rather than on a spoke.
Forty-two categories on one chart, from business interruption and data loss to privilege escalation, unauthorised access and the six distinct third-party exposures. Each arm is that category’s score out of ten, and the score is the proportion of its tasks that are complete. A long arm is a category the organisation has worked through. A short one is where it has not.
Heatmaps
Inherent next to residual, on the same grid
Likelihood against impact, before and after treatment. Select a cell and Netra lists the tasks behind the risks in it.
- Inherent risk shows exposure before any treatment
- Residual risk shows what is left after the linked tasks are done
- Click a cell to see exactly which tasks relate to it
Inherent risk
Residual risk
Illustration of how the grids read. Counts shown are examples, not client data.
Around the register
The register, and what surrounds it
The register sits among the controls that keep it honest.
Risk score
A score out of 10 for every risk, with inherent and residual side by side.
Risk groups
Risks by function, from Identify to Govern.
Treatment plan
Mitigate, transfer, avoid or accept, with an owner.
Tolerance thresholds
Board-set appetite, shown against the current picture.
Linked tasks
The work that treats each risk, and how much is done.
Named consequences
Risks are described by what they cause, such as service interruption or contract loss.
The Risk Manager in numbers
- 5 x 5
- Likelihood and impact, inherent and residual
- 4
- Treatments: mitigate, transfer, avoid or accept
- 6 groups
- Risks by function, from Identify to Govern
- / 10
- A risk score for every risk, driven by treatment progress
Inside a risk
A risk with its owner, its treatment and its proof of progress
Each risk is a record that a committee can read and an auditor can follow.
- 1Description and functionWhat the risk is, and where it sits from Identify to Recover.
- 2Security principlesConfidentiality, integrity and availability.
- 3Inherent and residualBefore and after treatment, against a tolerance threshold.
- 4Key risk flagPuts the risk on the directors' short list.
- 5Treatment plan and statusThe chosen treatment, its status and last review date.
- 6OwnerA named person who answers for it.
- 7Task completionHow much of the treating work is done.
Why it matters
A register that earns its numbers
Residual risk should fall because work was done, not because someone edited a cell.
The usual way
- An annual spreadsheet, out of date by the next quarter
- Residual risk edited by hand
- Treatment decisions with no link to the work
- A board pack built from memory
In Netra
- A register generated from your risk profile and frameworks
- Residual risk that follows the linked tasks
- Each treatment tied to tasks and an owner
- Heatmaps and a register export ready for the committee
Who uses it
Analysis dashboard
Every view a risk committee asks for
The analysis dashboard turns the register into the pictures a risk committee reads, all from the same live data.
What else is in Risk Manager
Key Risks view
A focused list for directors.
Business goals
Shown next to the risk picture they depend on.
Tolerance thresholds
Risk appetite set by the board, visible against today.
Owners and reviews
Every risk has an owner and a last-reviewed date.
A register that starts full
Generated from your profile, then assessed by your team.
Export for the pack
Download the register as a PDF for committees.
Works on the same record as
A task completed anywhere in Netra shows up here. Nothing is collected twice.
Questions about Risk Manager
How is Netra different from a spreadsheet or a compliance checklist?
Three ways. Netra builds your programme for you, so you start from populated policies, tasks, risks and controls rather than a blank template. Everything is connected, so one completed task and its evidence update every framework, policy, risk, audit and asset it touches. And control status is derived from completed work, not typed in by hand, so every number can be traced back to a task and a file.
Can Netra produce a report for our board?
Yes. One click generates a board-ready report for each framework from live data: executive summary, risk exposure, policy impact, a prioritised remediation roadmap, critical gaps, the full register and a sign-off page.
Can we add our own risks?
Risks are generated for your organisation from your risk profile and enabled frameworks, giving you a comprehensive starting register aligned to recognised risk taxonomies. Your work is to assess each risk, decide its treatment, assign owners, and drive the treatment through tasks.
What's the difference between the Risk Score and the severity?
Severity (Low/Medium/High/Extreme) answers "how dangerous is this risk?" and comes from Impact × Likelihood. The Risk Score (out of 10) answers "how far along is our treatment?" - it rises as the tasks mapped to the risk are completed, weighted by each task's importance. The higher the score, the more of the treatment is done. A risk can be Extreme severity yet score highly if its treatment is nearly complete.
Why hasn't my residual risk gone down after I set a treatment?
Choosing a treatment is the decision; residual risk reflects reality. It comes down only when the controls actually take effect - i.e. when the treating tasks are completed. Set the residual assessment to reflect the post-control position once the work is genuinely done.
How does risk treatment affect our budget?
Directly. Mitigation funds controls and projects; transfer funds insurance premiums; avoidance may forgo revenue; acceptance carries a potential loss. When the board approves the treatment plan across the register, it is effectively approving the security budget - which is why the CFO should read the register alongside the CISO.
Can I show these views to the board directly?
Yes - the twin heatmaps, the treatment distribution, and the register (or its PDF export) are built to be board-ready as they appear. The Key Risks filter gives directors a focused view of the risks that matter most.
See Risk Manager on your own frameworks
A demo with your frameworks and your kind of organisation, not a generic tour.
Next module: Audit Centre